EUVD-2026-63419

Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2026-18272

The Kenwood DNR1007XR's startUpdateProcess() function passes a user-supplied string directly to a system call without validation, enabling command injection as root. Exploitation requires physical access (CVSS 6.8 MEDIUM), and no firmware fix or workaround is currently available per ZDI-CAN-28981...

PT-2026-65939

Name of the Vulnerable Software and Affected Versions Kenwood DNR1007XR affected versions not specified Description Physically present attackers can execute arbitrary code with root privileges on affected devices without requiring authentication. The issue occurs within the startUpdateProcess...