CVE-2023-28899 Denial of Service via ECU reset service

By sending a specific reset UDS request via OBDII port of Skoda vehicles, it is possible to cause vehicle engine shutdown and denial of service of other vehicle components even when the vehicle is moving at a high speed. No safety critical functions affected...

CVE-2023-6248 Data leakage and arbitrary remote code execution in Syrus cloud devices

The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code on any Syrus4 device connected to the cloud service. The MQTT server also leaks the location, video and diagnostic data from each connect...

CVE-2023-6073

Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 and other vehicles of the VW Group with the same hardware and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls...

Design/Logic Flaw

Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 and other vehicles of the VW Group with the same hardware and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls...

CVE-2023-6073 DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECU

Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 and other vehicles of the VW Group with the same hardware and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls...

CVE-2023-6073

CVE-2023-6073 affects the Volkswagen ID.3 ICAS 3 IVI ECU. Affected component: ICAS 3 IVI ECU in VW Group vehicles with the same hardware. Description provided across sources states that an attacker can perform a Denial of Service to crash the ICAS 3 IVI ECU and spoof REST API volume commands to i...

CVE-2023-6073 DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECU

Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 and other vehicles of the VW Group with the same hardware and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls...

PT-2023-32498 · Volkswagen · Volkswagen Id.3

Name of the Vulnerable Software and Affected Versions: Volkswagen ID.3 and other vehicles of the VW Group with the same hardware affected versions not specified Description: An attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU and spoof volume setting commands to...

(Pwn2Own) Tesla Model 3 Gateway Firmware Signature Validation Bypass Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Tesla Model 3 vehicles. An attacker must first obtain the ability to execute privileged code on the Tesla infotainment system in order to exploit this vulnerability. The specific flaw exists within the...

VulnCheck KEV: CVE-2022-45699

Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter...

ecu.edu Cross Site Scripting vulnerability OBB-3279939

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-45699

Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter...

CVE-2022-45699

Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter...

PT-2023-14731

Name of the Vulnerable Software and Affected Versions APSystems ECU-R version 5203 Description The issue allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter in the administration interface. Recommendations For APSystems ECU-R version 5203,...

CVE-2022-45699

APSystems ECU-R firmware, version 5203, is affected by a command injection in the administration interface via the timezone parameter. The vulnerability allows an unauthenticated remote attacker to execute arbitrary commands as root, potentially compromising the solar power management system. Roo...

APsystems Access Control Error Vulnerability

APsystems is a microinverter from APsystems, Inc. Combining high efficiency power conversion with a user-friendly monitoring interface, it brings you reliable and smart energy. An access control error vulnerability exists in APsystems ENERGY COMMUNICATION UNIT ECU-C Power Control Software version...

CVE-2022-44037

An access control issue in APsystems ENERGY COMMUNICATION UNIT ECU-C Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allows attackers to access sensitive data and execute specific commands and functions with full admin rights without authenticating allows him to perform multiple...

Design/Logic Flaw

An access control issue in APsystems ENERGY COMMUNICATION UNIT ECU-C Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allows attackers to access sensitive data and execute specific commands and functions with full admin rights without authenticating allows him to perform multiple...

CVE-2022-44037

CVE-2022-44037 refers to an improper access control flaw in APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software (versions V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2) that allows attackers to access sensitive data and execute commands with full admin rights without authentication. The...

Genivia Dlt-daemon Buffer Overflow Vulnerability

Dlt-daemon is the DLT communication interface for Genivia's ECU. It collects and buffers log messages from one or more DLT users running on the ECU and makes them available to DLT clients upon request. A buffer overflow vulnerability exists in Genivia Dlt-daemon 2.18.8 and prior versions, which...