Lucene search
HistoryJan 12, 2024 - 4:15 p.m.
CVE-2023-28897
access control
vulnerability
škoda superb iii
infotainment
firmware
hardcoded secret value
uds services
mib3
2.0 tdi
2022
cve-2023-28897
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
5.7
Confidence
High
EPSS
0.001
Percentile
39.1%
The secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware.
Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.
Affected configurations
Node
skoda-autosuperb_3Match-
skoda-autosuperb_3_firmwareMatch2022
| Vendor | Product | Version | CPE |
|---|---|---|---|
| skoda-auto | superb_3 | - | cpe:2.3:h:skoda-auto:superb_3:-:*:*:*:*:*:*:* |
| skoda-auto | superb_3_firmware | 2022 | cpe:2.3:o:skoda-auto:superb_3_firmware:2022:*:*:*:*:*:*:* |
Related
cvelist
cvelist
CVE-2023-28897 Hard-coded password for UDS services
2024-01-12 15:55:00
prion
prion
Hardcoded credentials
2024-01-12 16:15:00
cve
cve
CVE-2023-28897
2024-01-12 16:15:51
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
5.7
Confidence
High
EPSS
0.001
Percentile
39.1%
Related for NVD:CVE-2023-28897