The kenwood DNR1007XR vCardParser flaw is a heap‑based buffer overflow that occurs when the system copies a user‑supplied string to a heap buffer without validating its length. This defect can be exploited to execute arbitrary code with root privileges. Because authentication is not required, an attacker who can physically access the device can trigger the overflow by providing a crafted vCard, leading to total compromise of the device.

Kenwood DNR1007XR vehicles. The CVE references only this model; version information is not specified in the advisory, so all firmware versions prior to the latest update linked in the Kenwood firmware archive are potentially vulnerable.

The CVSS score of 6.8 indicates moderate severity, while the lack of an available EPSS score leaves the exploitation probability uncertain. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local, requiring physical presence, yet no authentication is needed. Once triggered, the attacker can gain root privileges and completely control the device, jeopardizing safety and operational integrity.