CVE-2025-8653HIGH 8.8EPSS p32.2%

CVE-2025-8653CVE-2025-8653

Description

Kenwood DMX958XR JKRadioService Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Kenwood DMX958XR. Authentication is not required to exploit this vulnerability. The specific flaw exists within the JKRadioService. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26312.

Scoring

CVSS 3.08.8 (HIGH)
VectorCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.41% probability of exploitation · percentile 32.2% · 2026-06-19T12:03:05Z
Published2025-08-06
Last modified2025-08-07

Underlying weaknesses· 1

CWE-121

References

  1. https://www.zerodayinitiative.com/advisories/ZDI-25-801/

1

TypeTargetConfidenceTier
WeaknessStack-based Buffer Overflowcwe-1210%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-8654
CVE
CVE-2025-5478
CVE
CVE-2025-6292
CVE
CVE-2025-6291
CVE
D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability
CVE
CVE-2026-0793
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.