EUVD-2026-63419
GHSA-gqgc-2qvm-j37v
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Physical access is the sole attack vector; no authentication required; full C/I/A impact as commands execute as root with no scope change.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
1DescriptionCVE.org
Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the startUpdateProcess method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-28981.
AnalysisAI
Command injection in the Kenwood DNR1007XR automotive head unit's startUpdateProcess method allows physically present, unauthenticated attackers to execute arbitrary OS commands as root. The flaw stems from unsanitized user-supplied input passed directly to a system call inside the firmware update handler, granting full device compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Physical presence at the device is the mandatory prerequisite - the CVSS vector AV:P confirms the attack cannot be performed remotely. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 base score of 6.8 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately reflects the physical access requirement, which is the dominant risk-limiting factor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply any available firmware update from Kenwood. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Local privilege escalation in the Kenwood DNR1007XR network video recorder enables an attacker with existing low-privile
Local privilege escalation in Kenwood DNR1007XR network video recorder devices allows a low-privileged local attacker to
Root code execution on the Kenwood DNR1007XR in-vehicle navigation receiver is reachable by anyone with physical access
Heap-based buffer overflow in the vCardParser class of the Kenwood DNR1007XR automotive multimedia receiver allows physi
Out-of-bounds write in Kenwood DNR1007XR firmware enables physically present, unauthenticated attackers to execute arbit
Privilege escalation to root on the Kenwood DNR1007XR car navigation/dashcam device is possible for physically present a
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today