PT-2020-10187

Name of the Vulnerable Software and Affected Versions Mercedes-Benz HERMES version 1 Description A misconfiguration in the debug interface allows an attacker with direct physical access to device hardware to obtain cellular modem information. Recommendations For Mercedes-Benz HERMES version 1,...

PT-2020-10188

Name of the Vulnerable Software and Affected Versions Mercedes-Benz HERMES version 1.5 Description The issue is related to an authentication bypass in the debug interface, allowing an attacker with physical access to the device hardware to obtain system information. This could also involve a...

PT-2020-10191

Name of the Vulnerable Software and Affected Versions Mercedes-Benz HERMES version 2.1 Description A misconfiguration in the debug interface allows an attacker with direct physical access to device hardware to obtain cellular modem information. Recommendations For Mercedes-Benz HERMES version 2.1...

CVE-2019-19563: Undefined Security Weakness

A misconfiguration in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with direct physical access to device hardware to obtain cellular modem information...

CVE-2019-19561: Insecure Storage of Sensitive Information

A misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with direct physical access to device hardware to obtain cellular modem information...

CVE-2019-19557: Insecure Storage of Sensitive Information

A misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with direct physical access to device hardware to obtain cellular modem information...

PT-2020-10190

Name of the Vulnerable Software and Affected Versions Mercedes-Benz HERMES version 2.1 Description An authentication bypass in the debug interface allows an attacker with physical access to device hardware to obtain system information. Recommendations For Mercedes-Benz HERMES version 2.1, conside...

CVE-2019-19562: Improper Authentication

An authentication bypass in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with physical access to device hardware to obtain system information...

CVE-2019-19556: Undefined Security Weakness

An authentication bypass in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with physical access to device hardware to obtain system information...

stock.mercedes-benz.lu Cross Site Scripting vulnerability OBB-1412386

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

stock.mercedes-benz.lu Cross Site Scripting vulnerability OBB-1374864

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

stock.mercedes-benz.lu Cross Site Scripting vulnerability OBB-1352062

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-16142

On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a device name in the COMAND infotainment software...

Format string

On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a device name in the COMAND infotainment software...

CVE-2020-16142

On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a device name in the COMAND infotainment software...

CVE-2020-16142

The CVE pertains to Mercedes-Benz C‑Class AMG Premium Plus (C220 BlueTec) where the COMAND infotainment Bluetooth stack mishandles %x and %c format-string specifiers in a device name. Affected component: Bluetooth stack in the COMAND infotainment software. Root cause: improper handling of format-...

CVE-2020-16142: Use of Externally-Controlled Format String

On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a device name in the COMAND infotainment software...

PT-2020-14773

Name of the Vulnerable Software and Affected Versions Mercedes-Benz COMAND infotainment software affected versions not specified Description The issue concerns the Bluetooth stack in the COMAND infotainment software, which fails to properly handle %x and %c format-string specifiers in a device...

mercedes-oldtimer.net Cross Site Scripting vulnerability OBB-1258013

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Black Hat 2020: Mercedes-Benz E-Series Rife with 19 Bugs

The Mercedes-Benz E-Class went to market riddled with 19 vulnerabilities, which, among other things, could enable attackers to remotely unlock the car door and start its engine. Researchers say the flaws, detailed at Black Hat USA on Thursday, potentially impacted over 2 million Mercedes-Benz...