EUVD-2026-63415
GHSA-wc8p-vc98-chj3
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector and low privilege prerequisite confirmed by description; AC:H reflects additional exploitation complexity beyond simple code execution; full C/I/A impact upon root escalation.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the JKGenService. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-29066.
AnalysisAI
Local privilege escalation in Kenwood DNR1007XR network video recorder devices allows a low-privileged local attacker to achieve root-level code execution by exploiting command injection in the JKGenService service. The flaw (CWE-78) exists because user-supplied input is passed without sanitization to a system call, enabling shell metacharacter injection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has already achieved the ability to execute low-privileged code on the target Kenwood DNR1007XR device (PR:L, AV:L) - this is a hard prerequisite and cannot be bypassed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H places this vulnerability at a base score of 7.0, reflecting meaningful constraints: the attacker must already possess low-privileged local code execution on the device, and the high attack complexity (AC:H) introduces additional uncertainty around reliable exploitation - possibly timing-dependent or requiring specific device state. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Check the Kenwood firmware advisory page at https://www.kenwood.com/cs/ce/mm/firmware/2020/2020f/eng.html for any available firmware update addressing this flaw; no specific fixed firmware version number is confirmed from the available input data, so administrators should verify patch availability directly with Kenwood. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit your environment for Kenwood DNR1007XR devices and assess their criticality; restrict local access and disconnect non-essential internet connectivity to affected units. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Local privilege escalation in the Kenwood DNR1007XR network video recorder enables an attacker with existing low-privile
Command injection in the Kenwood DNR1007XR automotive head unit's startUpdateProcess method allows physically present, u
Root code execution on the Kenwood DNR1007XR in-vehicle navigation receiver is reachable by anyone with physical access
Heap-based buffer overflow in the vCardParser class of the Kenwood DNR1007XR automotive multimedia receiver allows physi
Out-of-bounds write in Kenwood DNR1007XR firmware enables physically present, unauthenticated attackers to execute arbit
Privilege escalation to root on the Kenwood DNR1007XR car navigation/dashcam device is possible for physically present a
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today