PT-2024-34515 · Kia · Kia Seltos

Nitinronge91 · Published 2024-11-22 · Updated 2025-01-13 · CVE-2024-51073

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions: KIA Seltos vehicle instrument cluster version 1.0

Description: An issue in the KIA Seltos vehicle instrument cluster allows attackers to control or disrupt CAN communication between the instrument cluster and CAN bus. The findings are disputed by the supplier due to the potentially unrealistic test environment and because the observed behavior follows the UDS specification.

Recommendations: For KIA Seltos vehicle instrument cluster version 1.0, consider restricting access to the CAN bus to minimize the risk of exploitation until a patch or official fix is available from the supplier. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2024-51073

Affected Products

Kia Seltos

References · 6

• 🔥 https://github.com/nitinronge91/KIA-SELTOS-Cluster-Vulnerabilities/blob/3755e3f692dce5b1ab06de2d04a2433c907ab21c/CVE/Control%20CAN%20communication%20for%20KIA%20SELTOS%20Cluster%20CVE-2024-51073.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-51073 · Security Note
• https://twitter.com/CVEnew/status/1859995418475540491 · Twitter Post
• https://iso.org/standard/77323.html · Note
• https://udsoncan.readthedocs.io/en/latest/udsoncan/services.html · Note
• https://t.me/cvenotify/107205 · Telegram Post