PT-2024-37556 · Nissan · Nissan Altima

Published 2024-08-15 · Updated 2024-08-30 · CVE-2024-6347

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Nissan Altima (2022)

Description The issue concerns unprotected privileged mode access through UDS session in the Blind Spot Detection Sensor ECU firmware, allowing attackers to trigger denial-of-service (DoS) by unauthorized access to the ECU's programming session. Additionally, no preconditions are implemented for ECU management functionality through UDS session, enabling attackers to disrupt normal ECU operations by triggering a control command without authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Improper Authorization

Weakness Enumeration

CWE-306

CWE-285

Related Identifiers

CVE-2024-6347

Affected Products

Nissan Altima

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-6347 · Security Note
• https://twitter.com/VulmonFeeds/status/1824121236948951394 · Twitter Post
• https://twitter.com/Cyberwald_talks/status/1824798566138732660 · Twitter Post
• https://asrg.io/security-advisories/CVE-2024-6347 · Note
• https://twitter.com/cr0wtom/status/1829532353733197900 · Twitter Post
• https://t.me/cvenotify/90903 · Telegram Post
• https://t.me/cvedetector/3246 · Telegram Post
• https://t.me/cvenotify/90778 · Telegram Post
• https://twitter.com/CVEnew/status/1824096568649056715 · Twitter Post