CVE-2026-18267

Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. By creating a symbolic link, an attacker can abuse the service to move a file to an arbitrary location. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28751.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector : AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.kenwood.com/cs/ce/mm/firmware/2020/2020f/eng.html
https://www.zerodayinitiative.com/advisories/ZDI-26-484/

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Enlace de actualización de firmware de Kenwood DNR1007XR tras vulnerabilidad de ejecución de código. Esta vulnerabilidad permite a atacantes presentes físicamente ejecutar código arbitrario en instalaciones afectadas de dispositivos Kenwood DNR1007XR. Autenticación no es requerida para explotar esta vulnerabilidad. La falla específica existe dentro del proceso de actualización de firmware. Al crear un enlace simbólico, un atacante puede abusar del servicio para mover un archivo a una ubicación arbitraria. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto de root. Fue ZDI-CAN-28751.

Information

Published : 2026-08-20 17:17

Updated : 2026-10-18 20:10

NVD link : CVE-2026-18267

Mitre link : CVE-2026-18267

CVE.ORG link : CVE-2026-18267

JSON object : View

Products Affected

No product.

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2026-18267", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18267", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T19:41:44.944090Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "affected": [{"source": "zdi-disclosures@trendmicro.com", "affectedData": [{"vendor": "Kenwood", "product": "DNR1007XR", "versions": [{"status": "affected", "version": "1.7.0003.1000"}], "defaultStatus": "unknown"}]}], "published": "2026-08-20T17:17:23.140", "references": [{"url": "https://www.kenwood.com/cs/ce/mm/firmware/2020/2020f/eng.html", "source": "zdi-disclosures@trendmicro.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-484/", "source": "zdi-disclosures@trendmicro.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the firmware update process. By creating a symbolic link, an attacker can abuse the service to move a file to an arbitrary location. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28751."}, {"lang": "es", "value": "Enlace de actualizaci\u00f3n de firmware de Kenwood DNR1007XR tras vulnerabilidad de ejecuci\u00f3n de c\u00f3digo. Esta vulnerabilidad permite a atacantes presentes f\u00edsicamente ejecutar c\u00f3digo arbitrario en instalaciones afectadas de dispositivos Kenwood DNR1007XR. Autenticaci\u00f3n no es requerida para explotar esta vulnerabilidad.\n\nLa falla espec\u00edfica existe dentro del proceso de actualizaci\u00f3n de firmware. Al crear un enlace simb\u00f3lico, un atacante puede abusar del servicio para mover un archivo a una ubicaci\u00f3n arbitraria. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto de root. Fue ZDI-CAN-28751."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "zdi-disclosures@trendmicro.com"}