ZDI-26-490: (Pwn2Own) Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability
This vulnerability allows physically present attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of the mount point for the USB filesystem. The issue results from incorrect permissions on a directory used by the product. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
Other sources
This vulnerability allows physically present attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.6. The following CVEs are assigned: CVE-2026-18273.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict physical access to Kenwood DNR1007XR devices to prevent physically present attackers from exploiting the USB mount point permissions issue.
Event History
Frequently Asked Questions
What is the severity of ZDI-26-490?
ZDI-26-490 has a CVSS score of 41, indicating a moderate risk associated with the vulnerability.
How do I fix ZDI-26-490?
To mitigate ZDI-26-490, ensure that the permissions on the Kenwood DNR1007XR device are properly configured to restrict unauthorized access.
What is the impact of ZDI-26-490?
The impact of ZDI-26-490 allows local privilege escalation by an attacker with physical access to the Kenwood DNR1007XR device.
Who can exploit ZDI-26-490?
Only physically present attackers can exploit ZDI-26-490 by executing low-privileged code on the affected system.
What devices are affected by ZDI-26-490?
ZDI-26-490 specifically affects Kenwood DNR1007XR devices that have default permission misconfigurations.