CVE-2024-8360

CVE-2024-8360 affects Visteon Infotainment systems. The flaw is in the REFLASH_DDU_ExtractFile function where a crafted software update file can trigger execution of a system call built from a user-supplied string, enabling remote code execution in the device context. Exploitation requires a phys...

CVE-2024-8360 Visteon Infotainment REFLASH_DDU_ExtractFile Command Injection Remote Code Execution Vulnerability

Visteon Infotainment REFLASHDDUExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerabilit...

CVE-2024-8359 Visteon Infotainment REFLASH_DDU_FindFile Command Injection Remote Code Execution Vulnerability

Visteon Infotainment REFLASHDDUFindFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability...

CVE-2024-8359

This CVE concerns Visteon Infotainment REFLASH_DDU_FindFile: a crafted software update file can trigger a system call from a user-supplied string, enabling a remote code execution with physical access and no authentication. Impacts are described as arbitrary code execution in the device context. ...

CVE-2024-8359 Visteon Infotainment REFLASH_DDU_FindFile Command Injection Remote Code Execution Vulnerability

Visteon Infotainment REFLASHDDUFindFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability...

CVE-2024-8358 Visteon Infotainment UPDATES_ExtractFile Command Injection Remote Code Execution Vulnerability

Visteon Infotainment UPDATESExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability...

CVE-2024-8358

CVE-2024-8358 affects Visteon Infotainment systems. A flaw in the UPDATES_ExtractFile function allows a crafted software update file to trigger a system call built from user-supplied data, enabling remote code execution in the device context. Exploitation requires physical access and no authentic...

CVE-2024-8358 Visteon Infotainment UPDATES_ExtractFile Command Injection Remote Code Execution Vulnerability

Visteon Infotainment UPDATESExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability...

CVE-2024-8357 Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability

Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment systems. Although authentication is required to exploit this...

CVE-2024-8357 Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability

Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment systems. Although authentication is required to exploit this...

CVE-2024-8357

Visteon Infotainment App SoC with Missing Immutable Root of Trust is affected. The flaw lies in the application SoC configuration and lack of properly configured hardware root of trust, enabling local privilege escalation and potentially arbitrary code execution during the boot process. Exploitat...

CVE-2024-8356 Visteon Infotainment VIP MCU Code Insufficient Validation of Data Authenticity Local Privilege Escalation Vulnerability

Visteon Infotainment VIP MCU Code Insufficient Validation of Data Authenticity Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment systems. An attacker must first obtain the ability to execute...

CVE-2024-8356

CVE-2024-8356 affects Visteon Infotainment VIP MCU firmware update process, where authenticity of the supplied firmware image is not verified before programming internal memory. This enables local privilege escalation: an attacker with low-privilege code execution can escalate to high privileges ...

CVE-2024-8356 Visteon Infotainment VIP MCU Code Insufficient Validation of Data Authenticity Local Privilege Escalation Vulnerability

Visteon Infotainment VIP MCU Code Insufficient Validation of Data Authenticity Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment systems. An attacker must first obtain the ability to execute...

CVE-2024-8355 Visteon Infotainment System DeviceManager iAP Serial Number SQL Injection Vulnerability

Visteon Infotainment System DeviceManager iAP Serial Number SQL Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment system. Authentication is not required to exploit this vulnerability. The...

CVE-2024-8355

The CVE-2024-8355 entry covers a SQL injection in Visteon Infotainment System DeviceManager’s iAP Serial Number handling. The flaw occurs when parsing the iAP Serial number, where an attacker can inject SQL via an unsafely constructed query string, allowing code execution with root privileges on ...

CVE-2024-8355 Visteon Infotainment System DeviceManager iAP Serial Number SQL Injection Vulnerability

Visteon Infotainment System DeviceManager iAP Serial Number SQL Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment system. Authentication is not required to exploit this vulnerability. The...

Visteon Infotainment 安全漏洞

Visteon Infotainment is an automotive infotainment system from Visteon Corporation USA. A security vulnerability exists in Visteon Infotainment that stems from the lack of a properly configured hardware trust root in the application system-on-chip SoC configuration, which could allow a local...

Visteon Infotainment 操作系统命令注入漏洞

Visteon Infotainment is an automotive infotainment system from Visteon Corporation. Visteon Infotainment suffers from an operating system command injection vulnerability that stems from an improper system call to the REFLASHDDUFindFile function when handling a specially crafted software update...

Visteon Infotainment SQL注入漏洞

Visteon Infotainment is an automotive infotainment system from Visteon Corporation. Visteon Infotainment suffers from a SQL injection vulnerability that stems from improper validation of user-supplied strings when DeviceManager parses iAP serial numbers, which could lead to an attacker executing...