The flaw arises from incorrect permissions on a directory used for mounting USB filesystems in Kenwood DNR1007XR devices. When those permissions are overly permissive, a local attacker who has already achieved low‑privileged code execution can manipulate the filesystem to elevate privileges to root, allowing arbitrary code execution and compromising the device’s confidentiality, integrity, and availability.

Kenwood DNR1007XR devices are affected. The data set does not list specific firmware or hardware revisions, so any implementation of this model that exposes a USB mount point with the described permission configuration is potentially vulnerable.

The CVSS score of 6.6 indicates a medium severity risk. The EPSS score is not available, which limits the ability to gauge current exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a physically present threat actor who can already run code at a low privilege level on the device, implying a local physical attack vector. While this raises the barrier to exploitation, the flaw remains exploitable when local access is feasible, resulting in a moderate risk level for environments that do not enforce strict physical security or timely firmware updates.