ZDI-26-490: (Pwn2Own) Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability
This vulnerability allows physically present attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.6. The following CVEs are assigned: CVE-2026-18273.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-490?
ZDI-26-490 has a CVSS score of 41, indicating a moderate risk associated with the vulnerability.
How do I fix ZDI-26-490?
To mitigate ZDI-26-490, ensure that the permissions on the Kenwood DNR1007XR device are properly configured to restrict unauthorized access.
What is the impact of ZDI-26-490?
The impact of ZDI-26-490 allows local privilege escalation by an attacker with physical access to the Kenwood DNR1007XR device.
Who can exploit ZDI-26-490?
Only physically present attackers can exploit ZDI-26-490 by executing low-privileged code on the affected system.
What devices are affected by ZDI-26-490?
ZDI-26-490 specifically affects Kenwood DNR1007XR devices that have default permission misconfigurations.