I think I have found a kernel mode exploit that works on all firmwares. I am still testing to see if it works with NON-OE firmwares or not.
I am not going to give any more details until I am sure.
Please do not get your hopes up or anything as this may not work.
Expect a proof of consept soon!