An incorrect permission assignment in the udhcpd service on Kenwood DNR1007XR devices permits a local attacker, who already has the ability to run code with limited privileges, to elevate privileges and execute code as root. The flaw arises from the service using a resource that does not have restrictive permissions, allowing an attacker to overwrite or modify that resource. This violation of file-system access controls directly compromises integrity and permits arbitrary code execution, potentially allowing full device takeover.

The affected product is Kenwood DNR1007XR. No specific firmware or hardware revision numbers are listed in the advisory, so any installation of this model running the udhcpd service is potentially vulnerable until a firmware update is applied.

The CVSS score of 7.8 indicates high severity. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified, though the lack of a listed KEV record suggests no confirmed remote exploitation has been reported yet. Inferred from the description, the attack vector is local: an attacker must already run code with limited privileges on the device. Once that condition is met, the attacker can use the incorrect permissions to execute root‑level code. The vulnerability is thus a significant local privilege escalation risk for any compromised Kenwood DNR1007XR device.