PT-2018-10759 · Htc+1 · Htc Customer-Link Bridge+1

Aaron Luo + 1 · Publicado 2018-02-27 · Atualizado 2020-08-28 · CVE-2018-1170

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Volkswagen Customer-Link App version 1.30 HTC Customer-Link Bridge (affected versions not specified)

Description This issue allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations. Authentication is not required to exploit this issue. The specific flaw exists within the Customer-Link App and Customer-Link Bridge, resulting from the lack of a proper protection mechanism against unauthorized firmware updates. An attacker can leverage this issue to inject CAN messages.

Recommendations For Volkswagen Customer-Link App version 1.30, update the protection mechanism to prevent unauthorized firmware updates. For HTC Customer-Link Bridge, implement proper protection against unauthorized firmware updates to prevent CAN message injection. As a temporary workaround, consider restricting access to the firmware update mechanism in both the Customer-Link App and the Customer-Link Bridge until a proper fix is available.

Correção

Protection Mechanism Failure

Enumeração de Fraquezas

CWE-693

Identificadores relacionados

CVE-2018-1170

ZDI-18-214

Produtos afetados

Htc Customer-Link Bridge

Volkswagen Customer-Link App

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-1170 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-18-214 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-1170 · Nota de Segurança