PT-2025-1392 · Mercedes Benz · Ntg 6

Published 2025-01-20 · Updated 2025-02-14 · CVE-2023-34406

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Mercedes Benz NTG 6 (affected versions not specified)

Description An issue exists in the user data import/export function of NTG 6 head units, where a possible integer overflow can occur. To exploit this, an attacker needs local access to the USB interface of the car. With prepared data, the attacker can cause the User-Data service to fail, resulting in the service instance restarting automatically.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2023-34406

Affected Products

Ntg 6

References · 7

• https://osv.dev/vulnerability/CVE-2023-34406 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34406 · Security Note
• https://twitter.com/CVEnew/status/1890170590658720009 · Twitter Post
• https://securelist.com/mercedes-benz-head-unit-security-research/115218 · Note
• https://t.me/cvenotify/111326 · Telegram Post
• https://t.me/cvedetector/18061 · Telegram Post
• https://t.me/true_secator/6638 · Telegram Post