CVE-2025-5834
CVE-2025-5834 is a high-severity vulnerability in Pioneer Dmh-wt7600nex Firmware with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1326.
Key facts
- Severity: High (CVSS 3.x base score 7.8)
- EPSS exploit prediction: 0% (15th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-19126
- Weakness: CWE-1326
- Affected product: Pioneer Dmh-wt7600nex Firmware
- Published:
- Last modified:
Description
Pioneer DMH-WT7600NEX Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to bypass authentication on affected installations of Pioneer DMH-WT7600NEX devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of a properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-26078.
Frequently asked questions
- What is CVE-2025-5834?
- Pioneer DMH-WT7600NEX Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to bypass authentication on affected installations of Pioneer DMH-WT7600NEX devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of a properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-26078.
- How severe is CVE-2025-5834?
- CVE-2025-5834 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2025-5834 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-5834?
- CVE-2025-5834 affects Pioneer Dmh-wt7600nex Firmware. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-5834?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2025-5834 have an EU (EUVD) identifier?
- Yes. CVE-2025-5834 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-19126.
- When was CVE-2025-5834 published?
- CVE-2025-5834 was published on 2025-06-25 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:o:pioneer:dmh-wt7600nex_firmware:3.05:*:*:*:*:*:*:*
More vulnerabilities in Pioneer Dmh-wt7600nex Firmware
- CVE-2024-23929 — High (CVSS 7.3): This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Pioneer…
- CVE-2025-5833 — Medium (CVSS 6.8): Pioneer DMH-WT7600NEX Root Filesystem Insufficient Verification of Data Authenticity Vulnerability. This vulnerability…
- CVE-2025-5832 — Medium (CVSS 6.8): Pioneer DMH-WT7600NEX Software Update Signing Insufficient Verification of Data Authenticity Vulnerability. This…
- CVE-2024-23928 — Medium (CVSS 6.5): This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected…
- CVE-2024-23930 — Medium (CVSS 4.3): This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations…
All CVEs affecting Pioneer Dmh-wt7600nex Firmware →
Other CWE-1326 vulnerabilities
- CVE-2025-2762 — High (CVSS 7.8): CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability. This vulnerability allows local…
- CVE-2024-8357 — High (CVSS 7.8): Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This…
- CVE-2024-32742 — High (CVSS 7.6): A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains an…
- CVE-2025-34502 — High (CVSS 7.0): Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules.…
- CVE-2022-38773 — Medium (CVSS 4.6): Affected devices do not contain an Immutable Root of Trust in Hardware. With this the integrity of the code executed on…
- CVE-2025-31929 — Medium (CVSS 4.2): A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions), IEC 1Ph 7.4kW…