PT-2020-20193 · Kia Motors · Kia Motors Head Unit

Published 2020-12-01 · Updated 2020-12-08 · CVE-2020-8539

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kia Motors Head Unit versions SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209

Description The issue allows an attacker to inject unauthorized commands by executing the micomd executable daemon, triggering unintended functionalities. This executable can also be used to inject commands that generate CAN frames sent into the M-CAN bus of the vehicle.

Recommendations For version SOP.003.30.18.0703, consider disabling the micomd executable daemon as a temporary workaround until a patch is available. For version SOP.005.7.181019, restrict access to the micomd executable daemon to minimize the risk of exploitation. For version SOP.007.1.191209, avoid using the micomd executable daemon in the affected system until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2020-8539

Affected Products

Kia Motors Head Unit

References · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/post/android/local/koffee.rb · Exploit
• 🔥 https://sowhat.iit.cnr.it/pdf/IIT-20-2020.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2020-8539 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8539 · Security Note
• https://gist.github.com/gianpyc/4dc8b0d0c29774a10a97785711e325c3 · Note
• https://t.me/cibsecurity/16999 · Telegram Post