Code Injection Vulnerability in Kenwood DNR1007XR Devices
CVE-2026-18272

6.8MEDIUM

Key Information:

Vendor

Kenwood

Status
Dnr1007xr
Vendor
CVE Published:
20 August 2026

What is CVE-2026-18272?

The Kenwood DNR1007XR contains a command injection vulnerability in the startUpdateProcess method. This flaw arises from inadequate validation of user-supplied strings which are utilized to execute system calls. Attackers with physical access can exploit this vulnerability to execute arbitrary code with root privileges, potentially compromising the entire system without requiring authentication.

Affected Version(s)

DNR1007XR 1.7.0003.1000

References

https://www.zerodayinitiative.com/advisories/ZDI-26-489/
x_research-advisory
https://www.kenwood.com/cs/ce/mm/firmware/2020/2020f/eng....
vendor-advisory

CVSS V3.0

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.