ZDI-CAN-29066: ZDI-26-485: (Pwn2Own) Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the JKGenService. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2026-18268.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What systems are affected by ZDI-CAN-29066?
The ZDI-CAN-29066 vulnerability affects Kenwood DNR1007XR devices.
What type of attack does ZDI-CAN-29066 allow?
ZDI-CAN-29066 allows local attackers to escalate privileges on affected systems.
What is the CVSS rating for ZDI-CAN-29066?
The CVSS rating for ZDI-CAN-29066 is 7.0.
How can an attacker exploit ZDI-CAN-29066?
An attacker must first execute low-privileged code on the target system to exploit ZDI-CAN-29066.
What is the risk level of ZDI-CAN-29066?
ZDI-CAN-29066 has been assigned a risk level of 44.