Details of VAR-202508-0109

ID

VAR-202508-0109

CVE

CVE-2025-8656

TITLE

JVCKENWOOD Corporation of DMX958XR Vulnerabilities related to flaws in protection mechanisms in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-011093

DESCRIPTION

Kenwood DMX958XR Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows physically present attackers to downgrade software on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the libSystemLib library. The issue results from the lack of proper validation of version information before performing an update. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-26355. JVCKENWOOD Corporation of DMX958XR The firmware contains vulnerabilities related to the failure of protection mechanisms.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The Kenwood DMX958XR is an in-vehicle infotainment system from Kenwood

Trust: 2.79

sources: NVD: CVE-2025-8656 // JVNDB: JVNDB-2025-011093 // ZDI: ZDI-25-804 // CNVD: CNVD-2025-20283

IOT TAXONOMY

category:

['IoT']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-20283

AFFECTED PRODUCTS

vendor:	jvckenwood	model:	dmx958xr	scope:	eq	version:	1.0.0509.3100	Trust: 1.0
vendor:	jvckenwood	model:	dmx958xr	scope:	eq	version:	dmx958xr firmware 1.0.0509.3100	Trust: 0.8
vendor:	jvckenwood	model:	dmx958xr	scope:	eq	version:	-	Trust: 0.8
vendor:	jvckenwood	model:	dmx958xr	scope:	-	version:	-	Trust: 0.8
vendor:	kenwood	model:	dmx958xr	scope:	-	version:	-	Trust: 0.7
vendor:	kenwood	model:	dmx958xr	scope:	eq	version:	1.0.0509.3100	Trust: 0.6

sources: ZDI: ZDI-25-804 // CNVD: CNVD-2025-20283 // JVNDB: JVNDB-2025-011093 // NVD: CVE-2025-8656

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com:	CVE-2025-8656
value:	MEDIUM
Trust: 1.0
OTHER:	JVNDB-2025-011093
value:	MEDIUM
Trust: 0.8
ZDI:	CVE-2025-8656
value:	MEDIUM
Trust: 0.7
CNVD:	CNVD-2025-20283
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2025-20283
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

zdi-disclosures@trendmicro.com:	CVE-2025-8656
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.9
impactScore:	5.9
version:	3.0
Trust: 1.0
OTHER:	JVNDB-2025-011093
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8
ZDI:	CVE-2025-8656
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.9
impactScore:	5.9
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-25-804 // CNVD: CNVD-2025-20283 // JVNDB: JVNDB-2025-011093 // NVD: CVE-2025-8656

PROBLEMTYPE DATA

problemtype:	CWE-693	Trust: 1.0
problemtype:	Malfunction of protection mechanism (CWE-693) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-011093 // NVD: CVE-2025-8656

EXTERNAL IDS

db:	NVD	id:	CVE-2025-8656	Trust: 3.9
db:	ZDI	id:	ZDI-25-804	Trust: 3.1
db:	JVNDB	id:	JVNDB-2025-011093	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-26355	Trust: 0.7
db:	CNVD	id:	CNVD-2025-20283	Trust: 0.6

sources: ZDI: ZDI-25-804 // CNVD: CNVD-2025-20283 // JVNDB: JVNDB-2025-011093 // NVD: CVE-2025-8656

REFERENCES

url:	https://www.zerodayinitiative.com/advisories/zdi-25-804/	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2025-8656	Trust: 0.8

sources: CNVD: CNVD-2025-20283 // JVNDB: JVNDB-2025-011093 // NVD: CVE-2025-8656

CREDITS

Synacktiv

Trust: 0.7

sources: ZDI: ZDI-25-804

SOURCES

db:	ZDI	id:	ZDI-25-804
db:	CNVD	id:	CNVD-2025-20283
db:	JVNDB	id:	JVNDB-2025-011093
db:	NVD	id:	CVE-2025-8656

LAST UPDATE DATE

2025-09-08T23:07:39.326000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-25-804	date:	2025-08-05T00:00:00
db:	CNVD	id:	CNVD-2025-20283	date:	2025-09-04T00:00:00
db:	JVNDB	id:	JVNDB-2025-011093	date:	2025-08-08T09:03:00
db:	NVD	id:	CVE-2025-8656	date:	2025-08-07T16:49:34.430

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-25-804	date:	2025-08-05T00:00:00
db:	CNVD	id:	CNVD-2025-20283	date:	2025-09-05T00:00:00
db:	JVNDB	id:	JVNDB-2025-011093	date:	2025-08-08T00:00:00
db:	NVD	id:	CVE-2025-8656	date:	2025-08-06T02:15:54.517