PT-2024-34516 · Kia · Kia Seltos

Nitinronge91 · Published 2024-11-22 · Updated 2025-01-13 · CVE-2024-51074

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions: KIA Seltos vehicle instrument cluster version 1.0

Description: The issue concerns incorrect access control in the KIA Seltos vehicle instrument cluster, allowing attackers to change odometer readings by targeting the instrument cluster through the unsecured CAN network. It is noted that the CAN bus is not externally exposed and the packets can only increase the odometer reading, which typically has no value to an adversary. The findings are disputed by the supplier due to the potentially unrealistic test environment and because the observed behavior follows the UDS specification.

Recommendations: For KIA Seltos vehicle instrument cluster version 1.0, consider restricting access to the instrument cluster to minimize the risk of exploitation. As a temporary workaround, disabling the ability to modify odometer readings through the CAN network may help until a more permanent solution is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2024-51074

Affected Products

Kia Seltos

References · 6

• 🔥 https://github.com/nitinronge91/KIA-SELTOS-Cluster-Vulnerabilities/blob/0446f6fe6299eb39310e996c73d5513e70d76353/CVE/Odometer%20Manipulation%28Increase%29%20for%20KIA%20SELTOS%20Cluster%20CVE-2024-51074.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-51074 · Security Note
• https://t.me/cvenotify/107206 · Telegram Post
• https://t.me/cvenotify/106391 · Telegram Post
• https://twitter.com/CVEnew/status/1859995419591225631 · Twitter Post
• https://en.wikipedia.org/wiki/CAN_bus · Note