Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability

A command injection vulnerability allowing remote code execution has been identified in the Kenwood DMX958XR model, specifically within the JKWifiService component. This issue arises from inadequate validation of user-supplied strings, which can be exploited to execute arbitrary code with root privileges. Notably, authentication is not required for exploitation.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device, with the executed code running in the context of the root user.

Remediation

Due to the nature of this vulnerability, the primary recommendation is to limit physical interaction with the device.