CVE-2023-34399

The Mercedes-Benz NTG6 head-unit and MBUX multimedia systems are vulnerable to an integer overflow in the Boost library . This issue occurs when processing values (specifically cid ) during the import or export of profile settings via USB . An attacker can exploit this vulnerability to trigger a ...

CVE-2023-34404

The Mercedes-Benz head-unit NTG6 contains a vulnerability where Ethernet pins on the Base Board can be used to connect to the CSB module . An attacker with physical access to these pins can gain access to the internal network. By accessing a specific port, the attacker can send call requests to a...

CVE-2023-34398: NULL Pointer Dereference

Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost library. The boost library contains a vulnerability/null pointer dereference...

CVE-2024-37600: Stack-based Buffer Overflow

An issue was discovered in Mercedes Benz NTG New Telematics Generation 6 through 2021. A possible stack buffer overflow in the Service Broker service affects NTG 6 head units. To perform this attack, physical access to Ethernet pins of the head unit base board is needed. With a static IP address,...

CVE-2023-34401: Out-of-bounds Read

Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside profile folder there is a file, which is encoded with proprietary UD2 codec. Due to missed size checks in the enapsulate file, attacker can achieve Out-of-Bound Read in heap memory...

Mercedes-Benz NTG security vulnerabilities

Mercedes-Benz NTG is an automobile from Mercedes-Benz Germany. A security vulnerability exists in Mercedes-Benz NTG 6 that stems from insufficient file size checking when importing or exporting profile settings via USB...

UserData service Mercedes-Benz MBUX Unauthorized Access

The vulnerability of the UserData service in the Mercedes-Benz MBUX multimedia system is related to deficiencies in access control due to synchronization errors when using a shared resource “Race Mode”. Exploiting this vulnerability could allow an intruder to gain unauthorized access to protected...

MoCCA multimedia servicebroker framework Code Execution

The vulnerability of the servicebroker framework of the MoCCA multimedia system of Mercedes-Benz User Experience MBUX is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to execute arbitrary code or cause a service failure...

Boost library Heap Buffer Overflow DoS

The vulnerability of the Boost library in the Mercedes-Benz MBUX multimedia system is related to a pointer assignment error. Exploiting this vulnerability could allow an attacker to compromise the accessibility of the protected information...

Mercedes-Benz User Experience NWS_PF_setMacAddrExceptionIP Handler Command Execution

The vulnerability of the NWSPFsetMacAddrExceptionIP handler of the NetworkingService service in the Mercedes-Benz User Experience MBUX system is related to insufficient validation of input data during MAC address processing. Exploiting this vulnerability can allow an attacker to execute arbitrary...

Boost Library DoS

The vulnerability of the Boost library in the Mercedes-Benz MBUX multimedia system is related to integer overflow when processing values of cid. Exploiting this vulnerability can allow an attacker to cause a service failure...

libspeech DoS

The vulnerability of the libspeech service in the Mercedes-Benz User Experience MBUX multimedia system is related to the buffer overflow in dynamic memory during the processing of UD2 format files. Exploiting this vulnerability can allow an attacker to cause a service failure...

Mercedes-Benz Multimedia User Experience Service Buffer Overflow DoS

The vulnerabilities of the functions CHBString::constiterator::incrementSteps and CHBString::remove of the UserData service in the Mercedes-Benz Multimedia User Experience MBUX system are related to buffer overflows in dynamic memory during the decoding of UD2 format files. Exploiting these...

UserData service Import Export DoS

The vulnerability of the import/export function of the UserData service in the Mercedes-Benz MBUX multimedia system is related to errors in data type mixing. Exploiting this vulnerability can allow attackers to cause service failures...

PT-2025-1391 · Mercedes Benz · Mercedes-Benz Head-Unit Ntg6

Name of the Vulnerable Software and Affected Versions: Mercedes Benz head-unit NTG 6 affected versions not specified Description: The Mercedes Benz head-unit NTG 6 contains functions to import or export profile settings over USB. During parsing, it is possible to trigger a crash of the service...

PT-2025-1392 · Mercedes Benz · Ntg 6

Name of the Vulnerable Software and Affected Versions: Mercedes Benz NTG 6 affected versions not specified Description: An issue exists in the user data import/export function of NTG 6 head units, where a possible integer overflow can occur. To exploit this, an attacker needs local access to the...

Mercedes-Benz Head Unit security research report

Introduction This report covers the research of the Mercedes-Benz Head Unit, which was made by our team. Mercedes-Benz's latest Head Unit infotainment system is called Mercedes-Benz User Experience MBUX. We performed analysis of the first generation MBUX. MBUX was previously analysed by KeenLab...

PT-2025-1207 · Mercedes Benz · Mercedes Benz Ntg +1

Name of the Vulnerable Software and Affected Versions: Mercedes Benz NTG New Telematics Generation versions 6 through 2021 Description: The issue is related to a possible stack buffer overflow in the Service Broker service of the Mercedes-Benz User Experience MBUX system, which can allow an...

PT-2025-1230 · Mercedes Benz · Mbux +1

Name of the Vulnerable Software and Affected Versions: Mercedes-Benz head-unit NTG6 Description: The issue is related to the Mercedes-Benz head-unit NTG6, which has Ethernet pins on the Base Board to connect the module CSB. An attacker can connect to these pins and gain access to the internal...

PT-2025-1198 · Mercedes Benz · Ntg 6 +1

Name of the Vulnerable Software and Affected Versions: Mercedes Benz NTG New Telematics Generation 6 Description: A possible heap buffer overflow exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. Wit...