CVE-2018-1170

2018-03-0201:00:00

CWE-693

zdi

www.cve.org

8.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.1%

JSON

This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen Customer-Link App 1.30 and HTC Customer-Link Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Customer-Link App and Customer-Link Bridge. The issue results from the lack of a proper protection mechanism against unauthorized firmware updates. An attacker can leverage this vulnerability to inject CAN messages. Was ZDI-CAN-5264.

CNA Affected

[
  {
    "product": "Volkswagen Customer-Link App",
    "vendor": "Volkswagen",
    "versions": [
      {
        "status": "affected",
        "version": "1.30"
      }
    ]
  }
]

References

zerodayinitiative.com/advisories/ZDI-18-214