Code Execution Vulnerability in Kenwood DNR1007XR Devices
CVE-2026-18267

6.8MEDIUM

Key Information:

Vendor

Kenwood

Status
Dnr1007xr
Vendor
CVE Published:
20 August 2026

What is CVE-2026-18267?

A code execution vulnerability exists in the firmware update process of Kenwood DNR1007XR devices, allowing attackers with physical access to execute arbitrary code. By exploiting the flaw through symbolic links, an attacker can manipulate the firmware update service, enabling them to transfer files to unauthorized locations and run code as root. This vulnerability highlights the importance of physical security and proper firmware management in device configurations.

Affected Version(s)

DNR1007XR 1.7.0003.1000

References

https://www.zerodayinitiative.com/advisories/ZDI-26-484/
x_research-advisory
https://www.kenwood.com/cs/ce/mm/firmware/2020/2020f/eng....
vendor-advisory

CVSS V3.0

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.