PT-2015-6985 · Chrysler · Connect

Chris Valasek + 1 · Published 2015-07-21 · Updated 2016-12-24 · CVE-2015-5611

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Uconnect versions prior to 15.26.1

Description The issue allows remote attackers in the same cellular network to control vehicle movement, cause human harm or physical damage, or modify dashboard settings. This is achieved via vectors related to modification of entertainment-system firmware and access of the CAN bus due to insufficient "Radio security protection." A demonstration of this issue was performed on a 2014 Jeep Cherokee Limited FWD.

Recommendations For versions prior to 15.26.1, update to version 15.26.1 or later to resolve the issue.

Fix

Related Identifiers

CVE-2015-5611

Affected Products

Connect

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2015-5611 · Security Note
• http://blog.fcanorthamerica.com/2015/07/22/unhacking-the-hacked-jeep · Note
• http://www-odi.nhtsa.dot.gov/acms/cs/jaxrs/download/doc/UCM483036/RCLRPT-15V461-9407.pdf · Note
• https://twitter.com/0xcharlie/status/623171594349842433 · Note
• https://youtube.com/watch?v=MK0SrxBC1xs&feature=youtu.be · Note
• https://twitter.com/0xcharlie/status/623195051296993280 · Note
• http://securityfocus.com/bid/75993 · Note
• http://www-odi.nhtsa.dot.gov/acms/cs/jaxrs/download/doc/UCM483033/RCAK-15V461-4967.pdf · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-15-260-01 · Note
• https://twitter.com/0xcharlie/status/623258479730552832 · Note
• http://media.fcanorthamerica.com/newsrelease.do?id=16827&mid=1 · Note
• http://wired.com/2015/07/hackers-remotely-kill-jeep-highway · Note