Kenwood DMX958XR Command Injection Vulnerability in Firmware Update Process

A command injection vulnerability has been identified in the Kenwood DMX958XR model, allowing physically present attackers to execute arbitrary code with root privileges. The issue arises from inadequate validation of user-supplied strings in the firmware update process, enabling unauthorized code execution. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device, with the executed code running in the context of the root user.

Remediation

The vendor is reportedly working on a fix, but no specific update has been released yet. In the meantime, the only recommended mitigation is to limit interaction with the device.