ZDI-26-489: (Pwn2Own) Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the startUpdateProcess method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute arbitrary code in the context of root.
Other sources
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-18272.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ZDI-26-489 - Configuration
Update firmware/software so that startUpdateProcess performs proper validation of any user-supplied string prior to invoking the system call.
Kenwood DNR1007XR startUpdateProcess method Input validation for user-supplied string before executing system call = Apply proper validation/sanitization of the user-supplied string before it is used in the system call (to prevent command injection). - Compensating control
Because the vulnerability can be exploited by physically present attackers without authentication, restrict physical access to Kenwood DNR1007XR devices (e.g., lock the device/enclosure and control who can connect to or interact with it).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be physically present at an affected Kenwood DNR1007XR device. No authentication is required.
What level of access could exploitation provide?
Successful exploitation allows arbitrary code execution in the context of root, with high impact to confidentiality, integrity, and availability.
What input path is vulnerable?
The flaw is in the startUpdateProcess method, which does not properly validate a user-supplied string before using it in a system call.