{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CHIRP Kenwood ITM",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "advisories"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "----------------------------------------------------------------------------\nNotCVE Advisory \u2014 NotCVE-2026-0013\n----------------------------------------------------------------------------\n\n[-] Summary:\nEval injection in the Kenwood ITM file format driver of CHIRP, an\nopen-source application for programming amateur radios, allows an attacker\nwho can persuade a user to open a crafted radio file to execute arbitrary\nPython code with the privileges of that user. The affected path is reached\nthrough the ordinary File -\u003e Open flow in a stock installation; no dialog or\nconfirmation precedes execution. CVSS:3.1 7.8\n(AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).\n\n[-] Affected:\nCHIRP, chirp-next builds up to and including chirp-next-20260814.\nFixed in source at commit 39178db (2026-08-17); the researcher reports build\nchirp-next-20260821 ships the fix.\n\n[-] Technical Description:\nITMRadio._clean_tmode() in chirp/drivers/kenwood_itm.py read two CSV fields\nfrom the file being opened and passed each one directly to Python\u0027s built-in\neval() (lines 66-67):\n\n  TXSIG, whose evaluated result was assigned to mem.rtone\n  RXSIG, whose evaluated result was assigned to mem.ctone\n\nBoth values are attacker-controlled strings retrieved verbatim from a row of\nthe opened file via generic_csv.get_datum_by_header(). The driver expected a\nnumeric CTCSS tone, but no type check, allowlist, or parsing step\nconstrained the input, so any Python expression placed in either field was\nevaluated at file-load time. The commit message for the fix records the\nassumption plainly: the squelch fields \"were assumed to only be a float\".\n\nITMRadio is decorated with @directory.register and declares VENDOR =\n\"Kenwood\", MODEL = \"ITM\" and FILE_EXTENSION = \"itm\". The driver ships in the\nstock distribution; no non-standard setting, plugin, or developer mode is\nrequired.\n\nThe .itm extension is not offered by the Open dialog\u0027s default filter, so\nthat variant requires the victim to switch the filter to \"All Files\". The\nresearcher\u0027s second proof of concept carries the same CSV payload in a .img\nfile with a trailing CHIRP metadata blob naming vendor \"Kenwood\" and model\n\"ITM\"; directory.get_radio_by_image() selects a driver by comparing that\nembedded metadata against registered classes, which is consistent with a\n.img file routing to this driver under the default filter.\n\nThe code runs in the CHIRP process with the victim user\u0027s privileges, before\nany channel data is displayed. No elevation is involved; the impact is\nbounded by what that user can reach.\n\nThe fix removes both eval() calls and replaces them with\nkenwood_tone.parse_qtdqt() feeding chirp_common.split_tone_decode().\n\nWeaknesses:\nCWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code\n        (\u0027Eval Injection\u0027)\nCAPEC-35: Leverage Executable Code in Non-Executable Files\nCAPEC-242: Code Injection\n\nProof-of-concept files for both delivery variants are published in the\nresearcher\u0027s repository (see References).\n\n[-] Timeline:\n[17/08/2026] - Reported to the CHIRP maintainer; fixed the same day\n               (39178db).\n[21/08/2026] - Build chirp-next-20260821 reported to ship the fix.\n[21/08/2026] - No CVE assigned; NotCVE ID reserved instead.\n[22/08/2026] - Published as NotCVE-2026-0013.\n\n[-] Credit:\nDiscovered by Christopher Duram\n(https://www.linkedin.com/in/christopherduram/).\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0013\n\n[-] References:\nhttps://github.com/cduram/CHIRP-CodeExecution_via_Malicious_ImageFile\nhttps://github.com/kk7ds/chirp/commit/39178dbfc4fece083ab9ed20286d6ae3a91a718e\nhttps://github.com/kk7ds/chirp/blob/39178dbfc4fece083ab9ed20286d6ae3a91a718e~1/chirp/drivers/kenwood_itm.py\nhttps://github.com/kk7ds/chirp/blob/master/chirp/drivers/kenwood_itm.py\nhttps://github.com/kk7ds/chirp/blob/master/chirp/directory.py\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/114"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/114"
        },
        {
          "url": "https://github.com/cduram/CHIRP-CodeExecution_via_Malicious_ImageFile"
        },
        {
          "url": "https://github.com/kk7ds/chirp/blob/39178dbfc4fece083ab9ed20286d6ae3a91a718e~1/chirp/drivers/kenwood_itm.py"
        },
        {
          "url": "https://github.com/kk7ds/chirp/blob/master/chirp/directory.py"
        },
        {
          "url": "https://github.com/kk7ds/chirp/blob/master/chirp/drivers/kenwood_itm.py"
        },
        {
          "url": "https://github.com/kk7ds/chirp/commit/39178dbfc4fece083ab9ed20286d6ae3a91a718e"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://notcve.org"
        },
        {
          "url": "https://notcve.org/form/"
        },
        {
          "url": "https://notcve.org/hall/"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0013"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/christopherduram/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/114"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[NotCVE-2026-0013] CHIRP Kenwood ITM Driver Eval Injection Allows Arbitrary Code Execution via Crafted Radio File",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0084",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/114",
            "automated": true,
            "contentSha256": "cc82dce2abcfc8aa298add650d69a778d4216f5c0cb2758f989edcf008cca081",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/114",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-22T11:50:49Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0084"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}