Kenwood DNR1007XR devices contain a buffer overrun in the tchdr_bytestream_read function caused by insufficient validation of incoming bytestream data, an instance of CWE-787. The vulnerability permits a physically present attacker to write past the end of an allocated buffer, allowing execution of arbitrary code in the operator context with root privileges. The resulting compromise could allow full control over the device’s operating system.

The flaw affects all Kenwood DNR1007XR devices; no specific firmware revisions are listed, so every deployment of this model is potentially vulnerable unless updated by Kenwood.

The CVSS score of 6.8 indicates a moderate severity. Authentication is not required to exploit this vulnerability, and based on the description, the likely attack vector is local physical access. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not been observed as of this analysis. Nevertheless, the ability to execute privileged code warrants prompt remediation.