Kenwood devices running the DNR1007XR firmware contain a command injection flaw in the JKGenService. The service fails to validate a user‑supplied string before passing it to an operating‑system call, allowing an attacker who can originally execute low‑privileged code on the device to inject arbitrary commands and elevate privileges to the system account. The vulnerability is a classic instance of CWE‑78, where unchecked input leads to command execution. Based on the description, it is inferred that the attacker must already possess some local code execution capability to leverage this flaw, as the bug is exploitable only from the inside of the device.

Kenwood DNR1007XR devices exposed to the JKGenService endpoint are affected. No specific firmware version ranges are listed in the CNA data; the flaw applies to installations that include the vulnerable service implementation.

The flaw receives a CVSS score of 7, indicating high severity. EPSS information is unavailable, and the issue is not listed in the CISA KEV catalog, so the current likelihood of widespread exploitation is unclear. Because the vulnerability requires local presence and prior code execution, the attack surface is mainly internal or compromised environments. Nonetheless, once an attacker gains a foothold, the flaw can be used to run arbitrary code as root, which would effectively nullify any remaining security controls on the device.