BaseFortify

Executive Summary

CVE-2026-78136 is an arbitrary code execution vulnerability in CHIRP, an open-source ham radio programming tool. The issue occurs in the Kenwood ITM driver where CSV field values are passed directly to Python's eval() function without validation. This allows attackers to execute malicious code if a user opens a specially crafted file. The vulnerability affects versions up to chirp-next-20260814 and was fixed by replacing eval() with proper parsing functions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if you are running a vulnerable version of CHIRP (up to chirp-next-20260814). Inspect CSV files opened in CHIRP for suspicious TXSIG or RXSIG values that may contain Python code. Review logs for unexpected program executions after opening files.

Useful 0 Not Useful 0

Impact Analysis

If you use CHIRP software, an attacker could trick you into opening a malicious file that executes arbitrary commands on your system. This could allow them to run programs, access sensitive data, or take control of your computer. The attack requires user interaction (opening a file) but no special privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows arbitrary code execution via malicious CSV files, which could lead to unauthorized data access, modification, or exfiltration. For GDPR, this could result in violations of data integrity and confidentiality requirements. For HIPAA, it may compromise protected health information if the software is used in healthcare settings. The lack of input validation in the Kenwood ITM driver exacerbates these risks by enabling attackers to execute commands with user privileges.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update CHIRP to the latest version (after 39178db). Avoid opening CHIRP files from untrusted sources. Disable Python eval() usage in CHIRP drivers if possible. Monitor system activity for unusual processes after file operations.

Useful 0 Not Useful 0