EUVD-2026-63418
GHSA-wcpw-j6pq-wqgp
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Physical presence is mandatory per the description; no authentication is needed; successful heap overflow yields full confidentiality, integrity, and availability compromise of the embedded root environment.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the vCardParser class. The issue results from the lack of proper validation of a user-supplied string before copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28974.
AnalysisAI
Heap-based buffer overflow in the vCardParser class of the Kenwood DNR1007XR automotive multimedia receiver allows physically present, unauthenticated attackers to execute arbitrary code with root privileges. The flaw stems from missing bounds validation when copying attacker-controlled string data into a heap-allocated buffer during vCard contact parsing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Physical presence at the device is mandatory - confirmed by CVSS AV:P - making all remote exploitation vectors impossible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is substantially constrained by the physical attack vector (CVSS AV:P), which eliminates all remote exploitation paths and is the single dominant limiting factor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to obtain and apply the latest available firmware for the Kenwood DNR1007XR from Kenwood's official firmware distribution page (https://www.kenwood.com/cs/ce/mm/firmware/2020/2020f/eng.html) and confirm with Kenwood support or the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-488/ that the update addresses the vCardParser heap overflow. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Local privilege escalation in the Kenwood DNR1007XR network video recorder enables an attacker with existing low-privile
Local privilege escalation in Kenwood DNR1007XR network video recorder devices allows a low-privileged local attacker to
Command injection in the Kenwood DNR1007XR automotive head unit's startUpdateProcess method allows physically present, u
Root code execution on the Kenwood DNR1007XR in-vehicle navigation receiver is reachable by anyone with physical access
Out-of-bounds write in Kenwood DNR1007XR firmware enables physically present, unauthenticated attackers to execute arbit
Privilege escalation to root on the Kenwood DNR1007XR car navigation/dashcam device is possible for physically present a
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today