ZDI-CAN-28981: ZDI-26-489: (Pwn2Own) Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the startUpdateProcess method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute arbitrary code in the context of root.
Other sources
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-18272.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ZDI-26-489 - Compensating control
Because Kenwood DNR1007XR startUpdateProcess is exploitable by physically present attackers without authentication, restrict physical access to the device to trusted personnel/locations only.
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-28981?
The severity of ZDI-CAN-28981 is rated at 6.8 on the CVSS scale.
How do I fix ZDI-CAN-28981?
To fix ZDI-CAN-28981, ensure that your Kenwood DNR1007XR firmware is updated to the latest version released by the manufacturer.
Who is affected by ZDI-CAN-28981?
ZDI-CAN-28981 affects users of Kenwood DNR1007XR devices that are physically accessible to attackers.
Is authentication required to exploit ZDI-CAN-28981?
No, authentication is not required to exploit the ZDI-CAN-28981 vulnerability.
What types of attacks can be executed due to ZDI-CAN-28981?
ZDI-CAN-28981 allows attackers to execute arbitrary code on the affected Kenwood DNR1007XR installations.