6.8

CVE-2025-8656

EPSS 0.05%
Veröffentlicht 06.08.2025 01:19:06
Zuletzt bearbeitet 07.08.2025 16:49:34
Quelle zdi-disclosures@trendmicro.com
CVE-Watchlists
Login
Unerledigt
Login

Kenwood DMX958XR Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows physically present attackers to downgrade software on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the libSystemLib library. The issue results from the lack of proper validation of version information before performing an update. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-26355.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Jvckenwood ≫ Dmx958xr Firmware Version1.0.0509.3100

Jvckenwood ≫ Dmx958xr Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.05%	0.135

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
zdi-disclosures@trendmicro.com	6.8	0.9	5.9	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-693 Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

https://www.zerodayinitiative.com/advisories/ZDI-25-804/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2025-8656

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-8656

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-8656

EUVD