CVE-2025-8656: jvckenwood dmx958xr firmware

csirt@kutim:~/threat-intel/cve/CVE-2025-8656

CVSS 6.8 · Medium EPSS 0,24%

Kerentanan Protection Mechanism Failure pada jvckenwood dmx958xr firmware. Skor CVSS 3.0 6.8 (Medium) menurut trendmicro.com.

Deskripsi (NVD)

Kenwood DMX958XR Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows physically present attackers to downgrade software on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the libSystemLib library. The issue results from the lack of proper validation of version information before performing an update. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-26355.

Rincian

Terbit di NVD: 6 Agustus 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.0: 6.8 (Medium), sumber trendmicro.com
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-693: Protection Mechanism Failure
EPSS (30 hari): 0,24% peluang dieksploitasi; lebih tinggi dari 13,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
jvckenwood	dmx958xr firmware	Versi 1.0.0509.3100

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.zerodayinitiative.com/advisories/ZDI-25-804/ advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.