CVE-2026-18267

Medium

Description

Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware update process. By creating a symbolic link, an attacker can abuse the service to move a file to an arbitrary location. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28751.

SeverityMedium

CVSS6.8

Exploit probability—

ProductDNR1007XR

PublishedAug 20, 2026

First seenAug 20, 2026

Weakness typeCWE-59Improper link resolution

How to fix

Vendor advisories

kenwood.com/cs/ce/mm/firmware/2020/2020f/eng.html

Affected products

Product	Affected versions	Fixed in
Kenwood DNR1007XR	1.7.0003.1000	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.