PT-2025-16333 · Bosch · Infotainment System Ecu

Radu Motspan · Published 2025-04-15 · Updated 2026-02-15 · CVE-2025-32063

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BOSCH Infotainment ECU (affected versions not specified)

Description A misconfiguration exists within the Infotainment ECU manufactured by BOSCH. This issue occurs during the startup phase of a specific systemd service, leading to the activation of developer features, including a disabled firewall and a launched SSH server. The vulnerability was initially identified on a Nissan Leaf ZE1 manufactured in 2020.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-32063

Affected Products

Infotainment System Ecu

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-32063 · Security Note
• https://t.me/purp_sec/618 · Telegram Post
• https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch · Note
• https://nissan.co.uk/vehicles/new-vehicles/leaf.html · Note
• http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf · Note
• https://reddit.com/r/u_Geblitztde/comments/1jzpzfq/gef%C3%A4hrliche_sicherheitsl%C3%BCcke_hacker_k%C3%B6nnen_autos · Reddit Post
• https://twitter.com/CVEnew/status/2022994286942286283 · Twitter Post
• https://t.me/CVEtracker/44755 · Telegram Post
• https://t.me/cveNotify/152057 · Telegram Post