CVE-2023-40291

Harman Infotainment 20190525031613 allows root access via SSH over a USB-to-Ethernet dongle with a password that is an internal project name.

CVE-2023-40293

Harman Infotainment 20190525031613 and later allows command injection via unauthenticated RPC with a D-Bus connection object.