EUVD-2026-63420
GHSA-cf99-wgcf-8gw4
Severity by source
AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Physical presence and prior low-privileged execution are both mandatory per description, confirming AV:P and PR:L; no complexity or interaction beyond that.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
1DescriptionCVE.org
Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows physically present attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the configuration of the mount point for the USB filesystem. The issue results from incorrect permissions on a directory used by the product. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-29070.
AnalysisAI
Privilege escalation to root on the Kenwood DNR1007XR car navigation/dashcam device is possible for physically present attackers who already hold low-privileged code execution on the device. The USB filesystem mount point is configured with incorrect default permissions (CWE-276), allowing a low-privileged process to write to or manipulate that directory and escalate to root with full code execution capability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two prerequisites must both be satisfied: (1) the attacker must be physically present with the Kenwood DNR1007XR device (CVSS AV:P confirms no remote exploitation path), and (2) the attacker must already possess the ability to execute low-privileged code on the target device - this is not a standalone privilege escalation from pure physical USB insertion but requires an existing foothold. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 vector AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 6.6, which accurately reflects the constrained attack surface: physical presence and prior low-privileged code execution are both mandatory prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the latest available firmware from Kenwood's official firmware distribution page (https://www.kenwood.com/cs/ce/mm/firmware/2020/2020f/eng.html); however, the specific version that resolves this permission misconfiguration has not been independently confirmed from available data - verify with Kenwood support that the firmware explicitly addresses ZDI-26-490 or CVE-2026-18273 before considering the system patched. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Local privilege escalation in the Kenwood DNR1007XR network video recorder enables an attacker with existing low-privile
Local privilege escalation in Kenwood DNR1007XR network video recorder devices allows a low-privileged local attacker to
Command injection in the Kenwood DNR1007XR automotive head unit's startUpdateProcess method allows physically present, u
Root code execution on the Kenwood DNR1007XR in-vehicle navigation receiver is reachable by anyone with physical access
Heap-based buffer overflow in the vCardParser class of the Kenwood DNR1007XR automotive multimedia receiver allows physi
Out-of-bounds write in Kenwood DNR1007XR firmware enables physically present, unauthenticated attackers to execute arbit
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today