PT-2020-17028 · Volkswagen · Discover Media

Published 2020-11-16 · Updated 2020-12-02 · CVE-2020-28656

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Volkswagen Polo 2019 Discover Media infotainment system

Description The issue concerns the update functionality of the Discover Media infotainment system, which allows physically proximate attackers to execute arbitrary code. This is possible because some unsigned parts of a metainfo file are parsed, leading to the potential for attacker-controlled files to be written to the infotainment system and executed as root.

Recommendations For the Volkswagen Polo 2019 Discover Media infotainment system, consider restricting physical access to the system to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the update functionality that parses unsigned parts of metainfo files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2020-28656

Affected Products

Discover Media

References · 4

• 🔥 https://contextis.com/en/blog/a-code-signing-bypass-for-the-vw-polo · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28656 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28656 · Vendor Advisory
• https://t.me/cvenotify/5594 · Telegram Post