EUVD-2026-63413
GHSA-wvhf-6gm4-v6jf
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Physical access required (AV:P), no auth needed (PR:N), low complexity once on-device; full root impact across C/I/A with no scope change.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the firmware update process. By creating a symbolic link, an attacker can abuse the service to move a file to an arbitrary location. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28751.
AnalysisAI
Root code execution on the Kenwood DNR1007XR in-vehicle navigation receiver is reachable by anyone with physical access to the device, requiring no authentication. The firmware update service improperly resolves symbolic links during file move operations (CWE-59), allowing an attacker who can write a symlink to the device filesystem to redirect that file operation to an arbitrary path and ultimately execute code with root privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Physical presence at the device is the mandatory prerequisite - the CVSS vector AV:P explicitly confirms this, and no remote or adjacent-network attack path exists. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 vector CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H assigns a base score of 6.8, correctly reflecting the physical attack vector (AV:P) as the primary limiting factor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Check the Kenwood firmware update page at https://www.kenwood.com/cs/ce/mm/firmware/2020/2020f/eng.html for an updated firmware release that addresses this symlink vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Local privilege escalation in the Kenwood DNR1007XR network video recorder enables an attacker with existing low-privile
Local privilege escalation in Kenwood DNR1007XR network video recorder devices allows a low-privileged local attacker to
Command injection in the Kenwood DNR1007XR automotive head unit's startUpdateProcess method allows physically present, u
Heap-based buffer overflow in the vCardParser class of the Kenwood DNR1007XR automotive multimedia receiver allows physi
Out-of-bounds write in Kenwood DNR1007XR firmware enables physically present, unauthenticated attackers to execute arbit
Privilege escalation to root on the Kenwood DNR1007XR car navigation/dashcam device is possible for physically present a
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allShare
External POC / Exploit Code
Leaving vuln.today