Dnr1007Xr
Monthly
Privilege escalation to root on the Kenwood DNR1007XR car navigation/dashcam device is possible for physically present attackers who already hold low-privileged code execution on the device. The USB filesystem mount point is configured with incorrect default permissions (CWE-276), allowing a low-privileged process to write to or manipulate that directory and escalate to root with full code execution capability. No public exploit code or active exploitation has been identified at time of analysis; the attack surface is inherently constrained by the physical access prerequisite and the embedded nature of the device.
Command injection in the Kenwood DNR1007XR automotive head unit's startUpdateProcess method allows physically present, unauthenticated attackers to execute arbitrary OS commands as root. The flaw stems from unsanitized user-supplied input passed directly to a system call inside the firmware update handler, granting full device compromise. No public exploit code has been identified at time of analysis, and exploitation is constrained by the requirement for physical device access.
Heap-based buffer overflow in the vCardParser class of the Kenwood DNR1007XR automotive multimedia receiver allows physically present, unauthenticated attackers to execute arbitrary code with root privileges. The flaw stems from missing bounds validation when copying attacker-controlled string data into a heap-allocated buffer during vCard contact parsing. No public exploit code or active exploitation has been identified at time of analysis; ZDI tracked this internally as ZDI-CAN-28974 and issued advisory ZDI-26-488.
Local privilege escalation in the Kenwood DNR1007XR network video recorder enables an attacker with existing low-privileged code execution to gain root-level access by exploiting incorrectly permissioned resources associated with the udhcpd DHCP service. Discovered by Zero Day Initiative and tracked as ZDI-CAN-29111/ZDI-26-487, the flaw stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), granting full C:H/I:H/A:H impact once the prerequisite foothold is established. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds write in Kenwood DNR1007XR firmware enables physically present, unauthenticated attackers to execute arbitrary code at root privilege via the tchdr_bytestream_read function. The device - an in-vehicle infotainment/navigation unit - fails to bounds-check user-supplied data during bytestream parsing, resulting in a heap or stack write past the allocated buffer. No public exploit or active CISA KEV listing has been identified at time of analysis, and real-world impact is materially constrained by the physical access prerequisite.
Local privilege escalation in Kenwood DNR1007XR network video recorder devices allows a low-privileged local attacker to achieve root-level code execution by exploiting command injection in the JKGenService service. The flaw (CWE-78) exists because user-supplied input is passed without sanitization to a system call, enabling shell metacharacter injection. No public exploit has been identified at time of analysis, and the device is not listed in CISA KEV, but successful exploitation yields full system compromise on the affected hardware.
Root code execution on the Kenwood DNR1007XR in-vehicle navigation receiver is reachable by anyone with physical access to the device, requiring no authentication. The firmware update service improperly resolves symbolic links during file move operations (CWE-59), allowing an attacker who can write a symlink to the device filesystem to redirect that file operation to an arbitrary path and ultimately execute code with root privileges. No public exploit code or CISA KEV listing was identified at time of analysis; the ZDI advisory (ZDI-26-484) is the primary disclosure source.
Privilege escalation to root on the Kenwood DNR1007XR car navigation/dashcam device is possible for physically present attackers who already hold low-privileged code execution on the device. The USB filesystem mount point is configured with incorrect default permissions (CWE-276), allowing a low-privileged process to write to or manipulate that directory and escalate to root with full code execution capability. No public exploit code or active exploitation has been identified at time of analysis; the attack surface is inherently constrained by the physical access prerequisite and the embedded nature of the device.
Command injection in the Kenwood DNR1007XR automotive head unit's startUpdateProcess method allows physically present, unauthenticated attackers to execute arbitrary OS commands as root. The flaw stems from unsanitized user-supplied input passed directly to a system call inside the firmware update handler, granting full device compromise. No public exploit code has been identified at time of analysis, and exploitation is constrained by the requirement for physical device access.
Heap-based buffer overflow in the vCardParser class of the Kenwood DNR1007XR automotive multimedia receiver allows physically present, unauthenticated attackers to execute arbitrary code with root privileges. The flaw stems from missing bounds validation when copying attacker-controlled string data into a heap-allocated buffer during vCard contact parsing. No public exploit code or active exploitation has been identified at time of analysis; ZDI tracked this internally as ZDI-CAN-28974 and issued advisory ZDI-26-488.
Local privilege escalation in the Kenwood DNR1007XR network video recorder enables an attacker with existing low-privileged code execution to gain root-level access by exploiting incorrectly permissioned resources associated with the udhcpd DHCP service. Discovered by Zero Day Initiative and tracked as ZDI-CAN-29111/ZDI-26-487, the flaw stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), granting full C:H/I:H/A:H impact once the prerequisite foothold is established. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds write in Kenwood DNR1007XR firmware enables physically present, unauthenticated attackers to execute arbitrary code at root privilege via the tchdr_bytestream_read function. The device - an in-vehicle infotainment/navigation unit - fails to bounds-check user-supplied data during bytestream parsing, resulting in a heap or stack write past the allocated buffer. No public exploit or active CISA KEV listing has been identified at time of analysis, and real-world impact is materially constrained by the physical access prerequisite.
Local privilege escalation in Kenwood DNR1007XR network video recorder devices allows a low-privileged local attacker to achieve root-level code execution by exploiting command injection in the JKGenService service. The flaw (CWE-78) exists because user-supplied input is passed without sanitization to a system call, enabling shell metacharacter injection. No public exploit has been identified at time of analysis, and the device is not listed in CISA KEV, but successful exploitation yields full system compromise on the affected hardware.
Root code execution on the Kenwood DNR1007XR in-vehicle navigation receiver is reachable by anyone with physical access to the device, requiring no authentication. The firmware update service improperly resolves symbolic links during file move operations (CWE-59), allowing an attacker who can write a symlink to the device filesystem to redirect that file operation to an arbitrary path and ultimately execute code with root privileges. No public exploit code or CISA KEV listing was identified at time of analysis; the ZDI advisory (ZDI-26-484) is the primary disclosure source.