Design/Logic Flaw

2023-11-1008:15:00

PRIOn knowledge base

www.prio-n.com

design flaw

logic flaw

denial of service

volkswagen

ivi ecu

vw group

rest api

audio volume

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls.

CPENameOperatorVersion
id.3_firmwarelt3.2

CPE	Name	Operator	Version
	id.3_firmware	lt	3.2

References

asrg.io/cve-2023-6073-dos-and-control-of-volume-settings-for-vw-id-3-icas3-ivi-ecu/