PT-2023-5021 · Harman · Harman Infotainment

Published 2023-08-13 · Updated 2023-08-21 · CVE-2023-40291

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Harman Infotainment version 20190525031613

Description The issue allows root access via SSH over a USB-to-Ethernet dongle with a password that is an internal project name. This is related to inadequate access control in the navigation and multimedia systems designed for use in ground vehicles. Exploitation of the issue may enable an attacker to gain root access through SSH using a USB-to-Ethernet key with a password.

Recommendations For Harman Infotainment version 20190525031613, consider disabling SSH access via USB-to-Ethernet dongles as a temporary workaround until a patch is available. Restrict access to the system using strong passwords and ensure that internal project names are not used as passwords to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

BDU:2023-05560

CVE-2023-40291

Affected Products

Harman Infotainment

References · 8

• 🔥 https://autohack.in/2023/07/26/dude-its-my-car-how-to-develop-intimacy-with-your-car · Exploit
• https://osv.dev/vulnerability/CVE-2023-40291 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05560 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-40291 · Security Note
• https://t.me/cibsecurity/68411 · Telegram Post
• https://t.me/cvenotify/56379 · Telegram Post
• https://twitter.com/CVEnew/status/1690934501424152576 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1690963276065107968 · Twitter Post