ZDI-CAN-29066: ZDI-26-485: (Pwn2Own) Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation Vulnerability
Published Jul 29, 2026
·Updated
This vulnerability allows local attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2026-18268.
Affected Software
1 affected component
Kenwood DNR1007XR=
Event History
Jul 29, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What systems are affected by ZDI-CAN-29066?
The ZDI-CAN-29066 vulnerability affects Kenwood DNR1007XR devices.
2
What type of attack does ZDI-CAN-29066 allow?
ZDI-CAN-29066 allows local attackers to escalate privileges on affected systems.
3
What is the CVSS rating for ZDI-CAN-29066?
The CVSS rating for ZDI-CAN-29066 is 7.0.
4
How can an attacker exploit ZDI-CAN-29066?
An attacker must first execute low-privileged code on the target system to exploit ZDI-CAN-29066.
5
What is the risk level of ZDI-CAN-29066?
ZDI-CAN-29066 has been assigned a risk level of 44.