Exploit / PoCcritical
Multiple flaws in Volkswagen Group's infotainment unit allow for vehicle compromise
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-28902 | An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause… | 3.3 | <1% | ||
| CVE-2023-28903 | An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause a… | 3.3 | <1% | ||
| CVE-2023-28904 | A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical access to the MIB3 ECU… | 5.2 | <1% | ||
| CVE-2023-28905 | A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it | 8.0 | <1% | ||
| CVE-2023-28906 | A command injection in the networking service of the MIB3 infotainment allows an attacker already presenting in the system to escalate privileges and obtain… | 7.8 | <1% | ||
| CVE-2023-28907 | There is no memory isolation between CPU cores of the MIB3 infotainment | 6.7 | <1% | ||
CVE-2023-28911+1 related CVE | A specific flaw exists within the Bluetooth stack of the MIB3 infotainment | 6.5 group max | <1% | ||
| CVE-2023-28909 | A specific flaw exists within the Bluetooth stack of the MIB3 unit | 8.0 | <1% | ||
| CVE-2023-28910 | A specific flaw exists within the Bluetooth stack of the MIB3 infotainment system | 8.0 | <1% | ||
| CVE-2023-28912 | The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical… | 5.7 | <1% | ||
| CVE-2023-29113 | The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication… | 6.3 | <1% |
From the original article
2 min read at securityaffairs.com
Researchers discovered multiple flaws in the infotainment systems of Volkswagen Group vehicles that could allow to track them in real-time. A team of security researchers from cybersecurity firm PCAutomotive discovered multiple vulnerabilities in the infotainment units used in some vehicles of the Volkswagen Group.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.