PT-2024-31990 · Byd · Byd Dilink Headunit System

Published 2024-12-10 · Updated 2024-12-11 · CVE-2024-46442

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BYD Dilink Headunit System versions 3.0 through 4.0

Description The issue allows attackers to bypass authentication via a bruteforce attack.

Recommendations For BYD Dilink Headunit System versions 3.0 through 4.0, consider implementing additional authentication measures to prevent bruteforce attacks, such as rate limiting or IP blocking, until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2024-46442

Affected Products

Byd Dilink Headunit System

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-46442 · Security Note
• https://github.com/zgsnj123/BYD_headunit_vuls/tree/main · Note
• https://twitter.com/CVEnew/status/1866864835700592811 · Twitter Post
• https://t.me/cvedetector/12550 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1866394787160453361 · Twitter Post
• https://bydauto.com.cn · Note
• http://byd.com · Note