Kenwood DNR1007XR EUVD-2026-63413

Physical presence at the device is the mandatory prerequisite - the CVSS vector AV:P explicitly confirms this, and no remote or adjacent-network attack path exists. No authentication is required once physical access is obtained, per CVSS PR:N. The attacker must be able to write a symbolic link to a filesystem location accessible by the firmware update service before triggering an update cycle. The firmware update process must be invocable by the attacker (e.g., via USB, SD card, or device menu). Exploitation is limited to: physical proximity to the target device, ability to mount or write to the device storage, and ability to initiate or wait for a firmware update event. Remote attackers, unauthenticated network users, and non-physically-present threat actors cannot exploit this vulnerability. The attack does not require any specific non-default configuration - the firmware update service is a standard feature of this device.

The CVSS 3.0 vector CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H assigns a base score of 6.8, correctly reflecting the physical attack vector (AV:P) as the primary limiting factor. Low complexity (AC:L) and no authentication requirement (PR:N) signal that once physical access is obtained, exploitation is straightforward. The high C/I/A impact reflects full root compromise. No EPSS data was provided in the input; given the physical-only vector and niche product category, opportunistic mass exploitation is not a realistic concern. The absence of a KEV listing and no confirmed public POC further limits immediate urgency. Real-world risk is concentrated in scenarios involving vehicle theft, service shop access, or insider threat - not remote or internet-based attack. SSVC assessment: exploitation status 'none publicly known'; automatable 'no' (requires physical presence); technical impact 'total' (root execution). Priority is low for most organizations but relevant for automotive OEM security and fleet operators.

An attacker with physical access to the Kenwood DNR1007XR - such as during an unattended vehicle situation or at a service facility - connects to the device's accessible filesystem interface (e.g., USB or SD card slot), places a crafted symbolic link at the location the firmware update service expects to move a file, then triggers the firmware update process. The update service follows the symlink, writes a controlled payload to an arbitrary filesystem location (such as /etc/cron.d or an init script), and the payload executes with root privileges on the next service invocation or system restart. No POC has been publicly confirmed, but the attack complexity is low once physical access is achieved.