# CVE-2026-18270: Kenwood DNR1007XR udhcpd privilege escalation via incorrect permissions

Source: https://junglewise.ai/threats/cve-2026-18270-kenwood-dnr1007xr-udhcpd-privilege-escalation-via-incorrect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18270 · Severity: high · CVSS 7.8 · Published 2026-08-20

The Kenwood DNR1007XR is a navigation and multimedia receiver for vehicles. A flaw in the udhcpd service (which manages DHCP network configuration) has incorrect file or directory permissions that allow a local attacker with low-privilege access to escalate to root, potentially enabling complete control over the device and access to sensitive navigation data or vehicle systems.

Technologies: [Kenwood DNR1007XR](https://junglewise.ai/threats/technologies/dnr1007xr). Vendors: [Kenwood](https://junglewise.ai/threats/vendors/kenwood).

## Quick answers

**Is CVE-2026-18270 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18270 being exploited in the wild.

**How severe is CVE-2026-18270?** High severity, with a CVSS score of 7.8, published 20 August 2026.

**Which products and versions are affected?** Kenwood DNR1007XR prior to firmware version 2.0.0003.

**Is there a fix for CVE-2026-18270?** A patch was published on 2026-07-21: Firmware update released addressing the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18270 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-18270?** Check whether you run Kenwood DNR1007XR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an incorrect permission assignment flaw in the udhcpd service running on Kenwood DNR1007XR devices. The service fails to properly restrict access to a resource (likely a file or directory), allowing a local attacker with low-privilege code execution to escalate privileges to root. The attack vector is local-only and requires the attacker to already have the ability to execute code on the system with a low privilege level. Exploitation results in full code execution in the root context, compromising device integrity and confidentiality. Kenwood released a firmware update (version 2.0.0003 published 2026-07-21) to address this vulnerability.

## Affected products

- Kenwood DNR1007XR prior to firmware version 2.0.0003

## Timeline

- 2026-02-03: disclosed: Vulnerability reported to Kenwood by Slow Horses of Qrious Secure
- 2026-07-21: patched: Firmware update released addressing the vulnerability
- 2026-07-29: advisory: ZDI-26-487 / ZDI-CAN-29111 coordinated public disclosure

## References

- [https://www.kenwood.com/cs/ce/mm/firmware/2020/2020f/eng.html](https://www.kenwood.com/cs/ce/mm/firmware/2020/2020f/eng.html)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-487/](https://www.zerodayinitiative.com/advisories/ZDI-26-487/)

## Related threats

- [Kenwood DNR1007XR USB incorrect default permissions privilege escalation](https://junglewise.ai/threats/cve-2026-18273-kenwood-dnr1007xr-usb-incorrect-default-permissions-privilege)
- [Kenwood DNR1007XR command injection in startUpdateProcess](https://junglewise.ai/threats/cve-2026-18272-kenwood-dnr1007xr-command-injection-in-startupdateprocess)
- [Kenwood DNR1007XR vCardParser heap buffer overflow](https://junglewise.ai/threats/cve-2026-18271-kenwood-dnr1007xr-vcardparser-heap-buffer-overflow)
- [Kenwood DNR1007XR out-of-bounds write in tchdr_bytestream_read](https://junglewise.ai/threats/cve-2026-18269-kenwood-dnr1007xr-out-of-bounds-write-in-tchdr-bytestream-read)
- [Kenwood DNR1007XR JKGenService command injection local privilege escalation](https://junglewise.ai/threats/cve-2026-18268-kenwood-dnr1007xr-jkgenservice-command-injection-local-privilege)