PT-2018-14334 · Daimler · Daimler Mercedes-Benz Me App

Marc Ruef · Publicado 2018-10-09 · Atualizado 2019-10-03 · CVE-2018-18071

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Daimler Mercedes-Benz Me app version 2.11.0-846

Description An issue in the Daimler Mercedes-Benz Me app allows the encrypted Connected Vehicle API data exchange between the app and a server to be intercepted. This could potentially allow unauthorized access to sensitive information such as latitude, longitude, and direction of travel, or enable malicious operations like unlocking the vehicle or using the Remote Parking Pilot.

Recommendations For Daimler Mercedes-Benz Me app version 2.11.0-846, consider restricting access to sensitive vehicle operations until a fix is available. As a temporary workaround, avoid using the app for critical functions like Remote Parking Pilot or unlocking the vehicle to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2018-18071

Produtos afetados

Daimler Mercedes-Benz Me App

Referências · 4

• 🔥 https://vuldb.com/?id.125081 · Exploit
• 🔥 https://scip.ch/en/?labs.20180405 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18071 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-18071 · Aviso do Fabricante