Incorrect Permission Assignment in Kenwood DNR1007XR udhcpd Leads to Local Privilege Escalation

Executive Summary

This vulnerability is a local privilege escalation flaw in the Kenwood DNR1007XR device. It exists due to incorrect permissions set on a resource used by the udhcpd service. An attacker with low-privileged code execution can exploit this to escalate privileges to root.

Useful 0 Not Useful 0

Detection Guidance

Detection requires checking the udhcpd service permissions on the Kenwood DNR1007XR device. Verify if the service runs with incorrect permissions that allow privilege escalation. Check for firmware version and compare it against the latest update from Kenwood.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows attackers to gain root-level access on the affected device. This could lead to full control over the system, enabling unauthorized data access, modification, or disruption of services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows local attackers to escalate privileges to root on affected Kenwood DNR1007XR devices. Such unauthorized privilege escalation could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR and HIPAA if the device processes personal or health information.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest firmware update from Kenwood to fix the incorrect permission assignment in the udhcpd service. Ensure the update addresses the privilege escalation issue reported by the Slow Horses team.

Useful 0 Not Useful 0