CVE-2025-8639
published 2025-08-06CVE-2025-8639: Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected…
PriorityP339medium6.8CVSS 3.0
AVPACLPRNUINSUCHIHAH
EPSS
0.95%
56.9th percentile
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26262.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jvckenwood | dmx958xr_firmware | — | — |
| kenwood | dmx958xr | — | — |
CVSS provenance
nvdv3.06.8MEDIUMCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cisa7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3gj8-pq5m-2h4f: Kenwood DMX958XR Firmware Update Command Injection Vulnerability
ghsa_unreviewed·2025-08-06
CVE-2025-8639 [MEDIUM] CWE-78 GHSA-3gj8-pq5m-2h4f: Kenwood DMX958XR Firmware Update Command Injection Vulnerability
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26262.
CISA
Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability
cisa·2025-03-03·CVSS 7.8
CVE-2018-8639 [HIGH] CWE-404 Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability
Vulnerability: Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability
Affected: Microsoft Windows
Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8639 ; https://nvd.nist.gov/vuln/detail/CVE-2018-8639
Remediation Due Date: 2025-03-24
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-08-06
Published