PT-2023-22036 · Volkswagen · Modular Infotainment Platform 3

Artem Ivachev · Published 2023-12-01 · Updated 2024-04-24 · CVE-2023-28896

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Modular Infotainment Platform 3 (MIB3) (affected versions not specified)

Description Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controller Area Network (CAN) bus in a form that can be easily decoded by attackers with physical access to the vehicle. The vulnerability was discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

CWE-261

Related Identifiers

CVE-2023-28896

Affected Products

Modular Infotainment Platform 3

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-28896 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28896 · Vendor Advisory
• https://t.me/cvenotify/61884 · Telegram Post
• https://t.me/cvenotify/62607 · Telegram Post
• https://twitter.com/NUYTSTECH/status/1740774214855266807 · Twitter Post
• https://asrg.io/security-advisories/cve-2023-28896 · Note
• https://t.me/cvenotify/77925 · Telegram Post