PT-2024-34514 · Kia · Kia Seltos

Nitinronge91 · Published 2024-11-22 · Updated 2025-01-10 · CVE-2024-51072

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: KIA Seltos vehicle instrument cluster software version 1.0 KIA Seltos vehicle instrument cluster hardware version 1.0

Description: The issue allows attackers to cause a Denial of Service (DoS) via ECU reset UDS service. It is noted that the findings came from a potentially unrealistic test environment and the ECUReset specification does not allow a manufacturer to require SecurityAccess and Authentication.

Recommendations: For KIA Seltos vehicle instrument cluster software version 1.0, consider disabling the ECU reset UDS service as a temporary workaround until a patch is available. For KIA Seltos vehicle instrument cluster hardware version 1.0, restrict access to the ECU reset functionality to minimize the risk of exploitation.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2024-51072

Affected Products

Kia Seltos

References · 5

• 🔥 https://github.com/nitinronge91/KIA-SELTOS-Cluster-Vulnerabilities/blob/628b1550f0093f79380929074b6a5e6ca6f2d04b/CVE/Denial%20of%20Service%20via%20ECU%20Reset%20Service%20For%20KIA%20SELTOS%20CVE-2024-51072.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-51072 · Security Note
• https://twitter.com/CVEnew/status/1859995417452130725 · Twitter Post
• https://iso.org/standard/77323.html · Note
• https://udsoncan.readthedocs.io/en/latest/udsoncan/services.html · Note