EUVD-2026-63416
GHSA-wg99-wchc-fc9x
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Physical access required (AV:P); no auth needed; full C/I/A impact as code runs as root with no scope change to external systems.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
1DescriptionCVE.org
Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the tchdr_bytestream_read function. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28980.
AnalysisAI
Out-of-bounds write in Kenwood DNR1007XR firmware enables physically present, unauthenticated attackers to execute arbitrary code at root privilege via the tchdr_bytestream_read function. The device - an in-vehicle infotainment/navigation unit - fails to bounds-check user-supplied data during bytestream parsing, resulting in a heap or stack write past the allocated buffer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Physical presence at the target device is required - the CVSS vector AV:P confirms this is not remotely exploitable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 base score of 6.8 reflects a physical attack vector (AV:P), low complexity (AC:L), no required privileges (PR:N), no user interaction (UI:N), and full confidentiality, integrity, and availability impact (C:H/I:H/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Check the Kenwood firmware advisory page at https://www.kenwood.com/cs/ce/mm/firmware/2020/2020f/eng.html for an updated firmware release that addresses this vulnerability; however, a specific patched firmware version is not independently confirmed from the available data - verify directly with Kenwood support. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Local privilege escalation in the Kenwood DNR1007XR network video recorder enables an attacker with existing low-privile
Local privilege escalation in Kenwood DNR1007XR network video recorder devices allows a low-privileged local attacker to
Command injection in the Kenwood DNR1007XR automotive head unit's startUpdateProcess method allows physically present, u
Root code execution on the Kenwood DNR1007XR in-vehicle navigation receiver is reachable by anyone with physical access
Heap-based buffer overflow in the vCardParser class of the Kenwood DNR1007XR automotive multimedia receiver allows physi
Privilege escalation to root on the Kenwood DNR1007XR car navigation/dashcam device is possible for physically present a
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today