PT-2018-14334 · Daimler · Daimler Mercedes-Benz Me App

Marc Ruef · Published 2018-10-09 · Updated 2019-10-03 · CVE-2018-18071

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Daimler Mercedes-Benz Me app version 2.11.0-846

Description An issue in the Daimler Mercedes-Benz Me app allows the encrypted Connected Vehicle API data exchange between the app and a server to be intercepted. This could potentially allow unauthorized access to sensitive information such as latitude, longitude, and direction of travel, or enable malicious operations like unlocking the vehicle or using the Remote Parking Pilot.

Recommendations For Daimler Mercedes-Benz Me app version 2.11.0-846, consider restricting access to sensitive vehicle operations until a fix is available. As a temporary workaround, avoid using the app for critical functions like Remote Parking Pilot or unlocking the vehicle to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2018-18071

Affected Products

Daimler Mercedes-Benz Me App

References · 4

• 🔥 https://vuldb.com/?id.125081 · Exploit
• 🔥 https://scip.ch/en/?labs.20180405 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18071 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18071 · Vendor Advisory