CVE-2026-18272

Name of the Vulnerable Software and Affected Versions Kenwood DNR1007XR (affected versions not specified)

Description Physically present attackers can execute arbitrary code with root privileges on affected devices without requiring authentication. The issue occurs within the startUpdateProcess() function due to insufficient validation of a user-supplied string before it is used in a system call, leading to command injection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.