CVE-2025-8644
📋 TL;DR
This vulnerability allows physically present attackers to execute arbitrary code with root privileges on Kenwood DMX958XR car multimedia receivers by exploiting a command injection flaw in the firmware update process. No authentication is required, making it accessible to anyone with physical access to the device. Only users of the specific Kenwood model are affected.
💻 Affected Systems
- Kenwood DMX958XR
📦 What is this software?
Dmx958xr Firmware by Jvckenwood
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full root control of the device, potentially compromising vehicle systems, stealing data, or using the device as an entry point to other connected systems.
Likely Case
Local attacker installs malware, modifies device functionality, or extracts sensitive information from the device.
If Mitigated
With physical security controls preventing unauthorized access, impact is limited to authorized users who would need to deliberately exploit the vulnerability.
🎯 Exploit Status
Exploitation requires physical access and knowledge of command injection techniques. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Kenwood support for latest firmware
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-25-792/
Restart Required: Yes
Instructions:
1. Visit Kenwood support website. 2. Download latest firmware for DMX958XR. 3. Transfer to USB drive. 4. Insert USB into device. 5. Follow on-screen firmware update instructions.
🔧 Temporary Workarounds
Physical Access Control
allPrevent unauthorized physical access to the device
Disable Unauthorized USB Ports
allIf possible, disable USB ports or restrict to trusted devices only
🧯 If You Can't Patch
- Implement strict physical security controls around the vehicle
- Disconnect or disable the device if not essential for operation
🔍 How to Verify
Check if Vulnerable:
Check firmware version against Kenwood's patched version listCheck Version:
Navigate to device Settings > System Information > Firmware VersionVerify Fix Applied:
Confirm firmware version matches or exceeds patched version from vendor📡 Detection & Monitoring
Log Indicators:
- Unusual firmware update attempts
- Unexpected system command execution
Network Indicators:
- None - local exploitation only
SIEM Query:
Not applicable - physical access required