ZDI-CAN-28980: ZDI-26-486: (Pwn2Own) Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability

Published Jul 29, 2026

Updated

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-18269.

Affected Software

1 affected component

Kenwood DNR1007XR

Event History

Jul 29, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28980?

ZDI-CAN-28980 has a CVSS base score of 6.8, indicating a moderate severity level.

How do I fix ZDI-CAN-28980?

To fix ZDI-CAN-28980, ensure your Kenwood DNR1007XR device is updated to the latest firmware provided by the manufacturer.

Who is affected by ZDI-CAN-28980?

ZDI-CAN-28980 affects all installations of Kenwood DNR1007XR devices that have not been patched.

Can ZDI-CAN-28980 be exploited remotely?

No, ZDI-CAN-28980 requires physical access to the Kenwood DNR1007XR device to exploit.

What is the nature of the vulnerability in ZDI-CAN-28980?

ZDI-CAN-28980 is an Out-Of-Bounds Write vulnerability that allows execution of arbitrary code on the device.