CVE-2021-23908

An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A type confusion issue affects MultiSvSetAttributes in the HiQnet Protocol, leading to remote code execution...

CVE-2021-23909

An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The SH2 MCU allows remote code execution...

CVE-2021-23906

An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A Message Length is not checked in the HiQnet Protocol, leading to remote code execution...

CVE-2020-28656

The update functionality of the Discover Media infotainment system in Volkswagen Polo 2019 vehicles allows physically proximate attackers to execute arbitrary code because some unsigned parts of a metainfo file are parsed, which can cause attacker-controlled files to be written to the infotainmen...

Modeling Interdependent Cybersecurity Threats Using Bayesian Networks: a Case Study on In-Vehicle Infotainment Systems

Cybersecurity threats are increasingly marked by interdependence, uncertainty, and evolving complexity challenges that traditional assessment methods such as CVSS, STRIDE, and attack trees fail to adequately capture. This paper reviews the application of Bayesian Networks BNs in cybersecurity ris...

CVE-2024-36842

An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57LV3.220220301, and Build Number PlatformVER:K24-2023/05/09-v0.01 allows a remote attacker to execute arbitrary code via the ADB port component...

CVE-2024-36842

An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57LV3.220220301, and Build Number PlatformVER:K24-2023/05/09-v0.01 allows a remote attacker to execute arbitrary code via the ADB port component...

Allwinner TS17 Android Infotainment System 安全漏洞

Allwinner TS17 Android Infotainment System is an in-vehicle entertainment information system from Allwinner China. A security vulnerability exists in the Allwinner TS17 Android Infotainment System, which stems from the ADB port component not properly validating input, which could lead to remote...

CVE-2024-36842

An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57LV3.220220301, and Build Number PlatformVER:K24-2023/05/09-v0.01 allows a remote attacker to execute arbitrary code via the ADB port component...

PT-2025-16356 · Unknown +1 · Oncord+ Android Infotainment Systems +1

Name of the Vulnerable Software and Affected Versions: Oncord+ Android Infotainment Systems version Android 12 Description: The issue allows a remote attacker to execute arbitrary code via the ADB port component. Recommendations: For Oncord+ Android Infotainment Systems version Android 12, consid...

CVE-2024-36842

CVE-2024-36842 affects Oncord+ Android Infotainment Systems (Android 12) on hardware TS17 with part F57L_V3.2_20220301 and Build K24-2023/05/09-v0.01. The issue allows a remote attacker to execute arbitrary code via the ADB port component due to input validation problems in that component. Severa...

Sony XAV-AX5500 1.13 - Firmware Update Validation Remote Code Execution (RCE)

Exploit Title: Sony XAV-AX5500 Firmware Update Validation Remote Code Execution Date: 11-Feb-2025 Exploit Author: lkushinada Vendor Homepage: https://www.sony.com/et/electronics/in-car-receivers-players/xav-ax5500 Software Link: https://archive.org/details/xav-ax-5500-v-113 Version: 1.13 Tested o...

1 Million Third-Party Android Devices Have a Secret Backdoor for Scammers

New research shows at least a million inexpensive Android devices—from TV streaming boxes to car infotainment systems—are compromised to allow bad actors to commit ad fraud and other cybercrime...

Mercedes-Benz NTG 安全漏洞

Mercedes-Benz NTG is an automobile from Mercedes-Benz Germany. A security vulnerability exists in Mercedes-Benz NTG 6 that originates from a heap buffer overflow in the User-Data import/export function. An attacker exploiting this vulnerability could cause the User-Data service to crash...

CVE-2024-6245

Use of Default Credentials vulnerability in Maruti Suzuki SmartPlay on Linux Infotainment Hub modules allows attacker to try common or default usernames and passwords.The issue was detected on a 2022 Maruti Suzuki Brezza in India Market. This issue affects SmartPlay: 66T0.05.50...

The vulnerability of the import/export function of the UserData service in the Mercedes-Benz MBUX multimedia system allows a perpetrator to trigger a service failure.

The vulnerability of the import/export function of the UserData service in the Mercedes-Benz MBUX multimedia system is related to errors in data type mixing. Exploiting this vulnerability can allow attackers to cause service failures...

The vulnerability of the REFLASH_DDU_FindFile function in the Visteon Infotainment automotive application allows a intruder to execute arbitrary code.

The vulnerability of the REFLASHDDUFindFile function in the Visteon Infotainment automotive application platform exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a hacker to execute arbitrary code in the basic operating system...

The vulnerability of the Visteon Infotainment automotive application platform allows a violator to execute arbitrary code and increase their privileges.

The vulnerability of the Visteon Infotainment automotive application platform is related to insufficient verification of data authenticity. Exploiting this vulnerability could allow an attacker to execute arbitrary code and enhance their privileges...

The vulnerability of the SoC application platform for Visteon Infotainment applications allows a violator to bypass authentication procedures and gain increased privileges.

The vulnerability of the SoC platform for Visteon Infotainment applications is related to the absence of a fixed root certificate in the equipment. Exploiting this vulnerability allows an attacker to bypass authentication procedures and gain increased privileges...

The vulnerability of the UPDATES_ExtractFile function in the Visteon Infotainment automotive application platform allows a hacker to execute arbitrary code.

The vulnerability of the UPDATESExtractFile function in Visteon Infotainment’s automotive application platform exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows an attacker to execute arbitrary code in the basic operating system...