CVE-2021-23909

PoC —

CVSS 3.1

9.8 critical

EPSS

2%p83

Published

May 13, 2021 (May 13, 2021)

Modified

Jun 17, 2026

Description

An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The SH2 MCU allows remote code execution.

Vendors: mercedes-benz
Products: hermes
Weakness: CWE-787
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.4%)

In the news2 stories

Experts found multiple flaws in Mercedes

Security AffairsJan 21, 08:58 UTC · Jan 21, 2025Vulnerability CVE-2024-37602 CVE-2024-37600 CVE-2024-37603+15 CVEs

Hacking the infotainment system used in Mercedes

Security AffairsMay 19, 14:17 UTC · May 19, 2021Vulnerability CVE-2021-23906 CVE-2021-23907 CVE-2021-23908+2 CVEs