CVE-2025-8655
📋 TL;DR
This vulnerability allows physically present attackers to execute arbitrary code with root privileges on Kenwood DMX958XR car multimedia receivers. Attackers can exploit the firmware update process via command injection without authentication. Only users of this specific Kenwood device model are affected.
💻 Affected Systems
- Kenwood DMX958XR
📦 What is this software?
Dmx958xr Firmware by Jvckenwood
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full root control of the device, potentially compromising connected systems, stealing data, or using the device as an attack vector against other connected vehicles or networks.
Likely Case
Local attacker executes arbitrary code to modify device functionality, install malware, or access sensitive information stored on the device.
If Mitigated
With physical security controls preventing unauthorized access to the device, impact is limited to authorized users only.
🎯 Exploit Status
Exploitation requires physical access to the device and knowledge of the command injection technique. No authentication is required once physical access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Kenwood support for latest firmware
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-25-803/
Restart Required: Yes
Instructions:
1. Visit Kenwood support website. 2. Download latest firmware for DMX958XR. 3. Transfer firmware to USB drive. 4. Insert USB into device. 5. Follow on-screen firmware update instructions. 6. Device will restart automatically.
🔧 Temporary Workarounds
Physical Access Control
allPrevent unauthorized physical access to the device by keeping vehicles locked and in secure locations.
Disable Unused Features
allDisable any unnecessary connectivity features that could be used as attack vectors if physical access is obtained.
🧯 If You Can't Patch
- Restrict physical access to vehicles containing vulnerable devices
- Monitor for suspicious device behavior or unexpected firmware update attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version in device settings menu; if not running latest patched version, device is vulnerable.Check Version:
Navigate to Settings > System Information > Firmware Version on the device interfaceVerify Fix Applied:
After firmware update, verify version number matches latest patched version from Kenwood support site.📡 Detection & Monitoring
Log Indicators:
- Unexpected firmware update attempts
- System command execution logs showing unusual commands
- Root privilege escalation attempts
Network Indicators:
- Unusual USB device connections if monitored
- Unexpected firmware download patterns
SIEM Query:
Not applicable - primarily physical access exploitation