Kenwood DNR1007XR CVE-2026-18271

Physical presence at the device is mandatory - confirmed by CVSS AV:P - making all remote exploitation vectors impossible. No authentication is required once physical access is obtained, confirmed by PR:N in the CVSS vector. The vulnerability is triggered by supplying a maliciously crafted vCard file to the device's vCardParser class, meaning the device must be made to process external vCard data (e.g., via USB media import or a contact synchronization mechanism). Exploitation is limited to threat actors who can achieve direct physical interaction with the head unit. Non-default or optional vCard import features may further constrain the attack surface depending on device configuration.

Real-world risk is substantially constrained by the physical attack vector (CVSS AV:P), which eliminates all remote exploitation paths and is the single dominant limiting factor. CVSS 6.8 accurately reflects this: despite C:H/I:H/A:H impact metrics, the physical requirement reduces the score well below what a network-reachable variant would carry. No KEV listing confirms the absence of observed active exploitation, and no POC is referenced in available data. EPSS data was not provided but would be expected to be very low given the physical-only access requirement. The product is a niche consumer automotive head unit with negligible enterprise footprint, further narrowing the realistic threat population to vehicle-adjacent adversaries - vehicle service personnel, valets, or thieves with brief unsupervised access. The CVSS vector is CVSS:3.0 rather than 3.1; metric interpretation remains consistent, though organizations should note the minor versioning difference when ingesting into scoring systems.

An attacker with brief unsupervised physical access - such as a valet attendant, automotive service technician, or vehicle thief - inserts a USB drive containing a specially crafted vCard (.vcf) file into the DNR1007XR. When the device's vCardParser class processes the file, an oversized string field overflows the heap buffer, corrupting adjacent memory and redirecting execution. The attacker achieves arbitrary code execution as root on the embedded system, potentially enabling persistent firmware modification, extraction of stored contacts, or installation of further implants.