Looking at the Attack Surfaces of the Kenwood DMX958XR IVI

This post maps the attack surface of the Kenwood DMX958XR IVI head unit, detailing vectors such as USB media parsing (multiple audio/video formats and filesystems), Bluetooth profiles/codecs, and a Wi‑Fi access point with services on TCP 7000/8086 and UDP 67/5353/35917/50002/60794. It highlights potential risk areas in Android Auto/Apple CarPlay connectivity and Kenwood’s Portal and Remote S apps (e.g., image handling and data persistence). The article provides an extensive list of open-source components present on the device and encourages further vulnerability research, noting no recent Pwn2Own head‑unit compromises via Android Auto/CarPlay and previewing a forthcoming firmware deep dive.