PT-2025-1198 · Mercedes Benz · Ntg 6+1
Published
2025-01-17
·
Updated
2025-02-18
·
CVE-2024-37601
CVSS v2.0
4.9
Medium
| Vector | AV:L/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Mercedes Benz NTG (New Telematics Generation) 6
Description
A possible heap buffer overflow exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. With prepared data, an attacker can cause the User-Data service to fail. The failed service instance will restart automatically. The vulnerability is also related to the functions
CHBString::const iterator::incrementSteps() and CHBString::remove() in the Mercedes-Benz User Experience (MBUX) system, which is associated with a buffer overflow in dynamic memory when decoding UD2 format files.Recommendations
For Mercedes Benz NTG (New Telematics Generation) 6, as a temporary workaround, consider disabling the user data import/export function until a patch is available. Restrict access to the USB interface of the car to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mbux
Ntg 6