PT-2018-18969 · Bmw · Hu Nbt

Published 2018-05-31 · Updated 2018-06-29 · CVE-2018-9312

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BMW HU NBT (Infotainment) component on vehicles produced in 2012 through 2018

Description The issue allows for a local attack when a USB device is plugged into the Head Unit HU NBT component.

Recommendations For vehicles produced in 2012 through 2018, consider restricting access to the USB port to minimize the risk of exploitation until a fix is available.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2018-9312

Affected Products

Hu Nbt

References · 4

• 🔥 https://keenlab.tencent.com/en/Experimental_Security_Assessment_of_BMW_Cars_by_KeenLab.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-9312 · Security Note
• https://theregister.co.uk/2018/05/23/bmw_security_bugs · Note
• http://securityfocus.com/bid/104258 · Note