Mikhail Evdokimov

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment versions (affected versions not specified) Description: A command injection in the networking service of the MIB3 infotainment allows an attacker already present in the system to escalate privileges and obtain administrative access to the system. The issue was originally discovered in a Skoda Superb III car with an MIB3 infotainment unit. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: MIB3 unit (affected versions not specified) Description: The issue concerns the storage of the synchronized phone contact book in clear-text by the MIB3 unit. This allows an attacker with either code execution privilege on the system or physical access to the system to obtain the vehicle owner's contact data. The vulnerability was originally discovered in a Skoda Superb III car with an MIB3 infotainment unit. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment (affected versions not specified) Description: A specific flaw exists within the Bluetooth stack of the MIB3 infotainment, resulting from the lack of proper validation of user-supplied data. This can lead to an arbitrary channel disconnection, allowing an attacker to cause a denial-of-service attack for every connected client of the infotainment device. The issue was originally discovered in a Skoda Superb III car with an MIB3 infotainment unit. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

[Content removed]

Name of the Vulnerable Software and Affected Versions: MIB3 unit (affected versions not specified) Description: A specific flaw exists within the Bluetooth stack of the MIB3 unit. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow when receiving fragmented HCI packets on a channel. An attacker can leverage this vulnerability to bypass the MTU check on a channel with enabled fragmentation. Consequently, this can lead to a buffer overflow in upper layer profiles, which can be used to obtain remote code execution. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment (affected versions not specified) Description: A specific flaw exists within the Bluetooth stack of the MIB3 infotainment, resulting from the lack of proper validation of user-supplied data. This can cause an integer overflow when receiving non-fragmented HCI packets on a channel. The issue was originally discovered in a Skoda Superb III car with an MIB3 infotainment unit OEM part number 3V0035820. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sony XAV-AX8500 (affected versions not specified) **Description** The issue is related to a heap-based buffer overflow in the Bluetooth L2CAP protocol, which can lead to remote code execution. This was demonstrated at Pwn2Own. The estimated number of potentially affected devices worldwide is not provided. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sony XAV-AX8500 (affected versions not specified) **Description** The issue concerns an improper isolation authentication bypass vulnerability in the Bluetooth functionality. It was discovered by Mikhail Evdokimov from PCAutomotive. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sony XAV-AX8500 (affected versions not specified) **Description** The issue is related to an integer overflow in the Bluetooth SDP protocol, which can lead to remote code execution. This was demonstrated at Pwn2Own. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sony XAV-AX8500 (affected versions not specified) **Description** The issue is related to a heap-based buffer overflow in the Bluetooth AVCTP protocol, which can lead to remote code execution. This was demonstrated at Pwn2Own. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sony XAV-AX8500 (affected versions not specified) **Description** The issue concerns a Bluetooth ERTM Channel Authentication Bypass. It was discovered by Mikhail Evdokimov from PCAutomotive. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bosch Infotainment ECU versions (affected versions not specified) **Description** A flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue is due to a lack of proper boundary validation of user-supplied data, which can lead to a stack-based buffer overflow when receiving a specific packet on the established upper layer L2CAP channel. An attacker can exploit this to obtain remote code execution on the Infotainment ECU with root privileges. The issue was first identified on Nissan Leaf ZE1 manufactured in 2020. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bosch Infotainment ECU (affected versions not specified) **Description** A flaw exists in the Bluetooth stack developed by Alps Alpine within the Infotainment ECU manufactured by Bosch. This is due to insufficient validation of user-supplied data, leading to a stack-based buffer overflow when a specific packet is received on the L2CAP channel. Successful exploitation could allow an attacker to achieve remote code execution on the Infotainment ECU with root privileges. The vulnerability was first identified on Nissan Leaf ZE1 vehicles manufactured in 2020. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** versions prior to 2025-32060 **Description** The system lacks kernel module signature verification. An attacker gaining root access through other means can load custom kernel modules into the kernel space and execute code within the kernel context, potentially gaining full system control. This issue was initially identified on Nissan Leaf ZE1 vehicles manufactured in 2020. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nissan Leaf versions manufactured in 2020 (affected versions not specified) **Description** A flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue is due to insufficient boundary validation of user-supplied data, leading to a stack-based buffer overflow when receiving a specific packet on the established upper layer L2CAP channel. An attacker can exploit this to achieve remote code execution on the Infotainment ECU with root privileges. The vulnerability was first identified on the Nissan Leaf ZE1 manufactured in 2020. Exploitation involves the Bluetooth Hands-Free Profile (HFP). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Squid versions 4.9 through 4.17 Squid versions 5.0.6 through 5.6 **Description** An issue was discovered due to inconsistent handling of internal URIs, which can lead to Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This may allow a remote attacker to bypass ACL protection and access cache manager information, including network structure, client credentials, client identifier, and client traffic behavior. **Recommendations** For Squid versions 4.9 through 4.17, update to a version newer than 5.7 to resolve the issue. For Squid versions 5.0.6 through 5.6, update to version 5.7 or newer to resolve the issue. As a temporary workaround, consider restricting access to the internal cache manager URL to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** janus-gateway versions through 0.10.0 **Description** An issue was discovered in janus-gateway, where the `janus sdp preparse` function in `sdp.c` has a NULL pointer dereference. **Recommendations** For versions through 0.10.0, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** janus-gateway versions through 0.10.0 **Description** An issue was discovered in janus-gateway, also known as Janus WebRTC Server. The `janus sdp process` function in `sdp.c` has a NULL pointer dereference. **Recommendations** For versions through 0.10.0, consider disabling the `janus sdp process` function as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** janus-gateway versions through 0.10.0 **Description** A stack-based buffer overflow issue was discovered in the janus sdp merge function in sdp.c. This issue can be exploited due to the lack of proper validation of input data. **Recommendations** For versions through 0.10.0, consider disabling the janus sdp merge function as a temporary workaround until a patch is available. Restrict access to the sdp.c module to minimize the risk of exploitation. Avoid using the janus-gateway until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.