Kenwood DNR1007XR CVE-2026-18270

The CVSS vector PR:L confirms that at minimum a low-privileged authenticated session or code execution context on the target Kenwood DNR1007XR is required before this vulnerability can be leveraged - direct remote unauthenticated exploitation of this specific flaw is not possible. The udhcpd service must be active on the device and the incorrectly permissioned resource must be accessible to the attacker's privilege level. AV:L (local attack vector) confirms exploitation cannot be triggered remotely without first obtaining a local foothold through a separate mechanism. No user interaction is required (UI:N) once the attacker has that initial access. Exploitation is limited by: the need for prior local code execution, the local-only attack vector ruling out network-based exploitation of this flaw in isolation, and the requirement that the udhcpd service be running.

The CVSS 3.0 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) faithfully characterizes the attack profile: local, low-complexity, requiring only a pre-existing low-privileged foothold. EPSS data was not supplied, preventing probabilistic exploitation probability assessment. The vulnerability is absent from the CISA KEV catalog and no publicly available exploit code has been identified, meaning the practical exploitation bar is currently higher than the CVSS score alone implies. Real-world risk is gated on an attacker first achieving code execution on the device - through weak credentials, a separate vulnerability, or physical access - which limits opportunistic mass exploitation. That said, even a mid-sized municipal IT team in sopot running NVR infrastructure on internet-adjacent segments should treat this as urgent if devices share access with untrusted users, because once initial access exists, the escalation to root is low-complexity and fully unattended. The niche deployment footprint of this specific Kenwood NVR model further bounds aggregate risk across enterprise environments, but device compromise yields full control of video recording infrastructure.

An attacker who has obtained a low-privileged shell on the Kenwood DNR1007XR - through default or reused credentials, a separate pre-auth vulnerability, or physical console access - discovers that a file or socket used by the udhcpd service is writable by unprivileged users. The attacker replaces or modifies that resource with a malicious payload (such as a script or binary), then waits for or triggers the udhcpd service to process it with root privileges, resulting in arbitrary command execution as root with full control over the device.