Kenwood DNR1007XR CVE-2026-18268

Exploitation requires that the attacker has already achieved the ability to execute low-privileged code on the target Kenwood DNR1007XR device (PR:L, AV:L) - this is a hard prerequisite and cannot be bypassed. The JKGenService must be running on the device, which is expected in normal operation. The high attack complexity (AC:H) per the CVSS vector indicates an additional condition beyond simple access, such as a race condition, a specific device state, or precise timing requirements, though the exact nature of this complexity is not detailed in the advisory. Exploitation is not possible remotely against an uncompromised device; an attacker without pre-existing local code execution cannot leverage this flaw directly. What limits exploitation further is the scope constraint (S:U): impact is confined to the compromised device itself and does not automatically extend to connected network systems.

The CVSS 3.0 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H places this vulnerability at a base score of 7.0, reflecting meaningful constraints: the attacker must already possess low-privileged local code execution on the device, and the high attack complexity (AC:H) introduces additional uncertainty around reliable exploitation - possibly timing-dependent or requiring specific device state. The scope is unchanged (S:U), meaning impact is confined to the vulnerable device itself rather than propagating to adjacent systems. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. The device is not listed in CISA KEV, and no public proof-of-concept has been identified. In practical terms, this vulnerability matters most in environments where physical or network access to the device's management interface is loosely controlled - even a mid-sized municipal fleet operation in inowroclaw relying on these recorders for vehicle monitoring should treat this as a meaningful patching priority if devices are accessible via shared network segments or managed by multiple personnel with varying privilege levels. The real-world risk is bounded by the prerequisite of pre-existing local access, making this a post-compromise escalation path rather than an initial intrusion vector.

An attacker who has obtained low-privileged shell access to the Kenwood DNR1007XR - through credential theft, a separate vulnerability, or physical access to a debug port - crafts a malicious string containing shell metacharacters and submits it as input to the JKGenService service. Because JKGenService passes this input directly to a system call without sanitization, the injected commands execute in the context of the root user, granting the attacker full administrative control over the device and its stored video data. No public exploit code has been identified, and AC:H suggests reliable exploitation may require additional conditions or repeated attempts.