PT-2025-1231 · Mercedes Benz · Mercedes-Benz Head-Unit Ntg6

Published 2025-01-17 · Updated 2025-02-18 · CVE-2023-34399

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mercedes-Benz head-unit NTG6 (affected versions not specified)

Description The issue is related to the import or export of profile settings over USB in the Mercedes-Benz head-unit NTG6. Some values are serialized using the boost library, which contains a vulnerability due to integer overflow. This vulnerability can be exploited to cause a denial of service. The estimated number of potentially affected devices and details about real-world incidents are not provided.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2025-00610

CVE-2023-34399

Affected Products

Mercedes-Benz Head-Unit Ntg6

References · 12

• https://bdu.fstec.ru/vul/2025-00610 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34399 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34399 · Vendor Advisory
• https://github.com/klsecservices/Advisories/blob/master/K-Mercedes-Benz-2023-004.md · Note
• https://twitter.com/cybercronai/status/1891253841074549226 · Twitter Post
• https://twitter.com/InezVlasblom/status/1891911051781820735 · Twitter Post
• https://twitter.com/BaseFortify/status/1891873938185040375 · Twitter Post
• https://t.me/cvenotify/111319 · Telegram Post
• https://twitter.com/CVEnew/status/1890170584635723938 · Twitter Post
• https://keenlab.tencent.com/en/whitepapers/Mercedes_Benz_Security_Research_Report_Final.pdf · Note
• https://securelist.com/mercedes-benz-head-unit-security-research/115218 · Note
• https://twitter.com/CVETracker/status/1890491408609316991 · Twitter Post