PT-2025-20887 · Bosch · Infotainment System Ecu

Radu Motspan · Published 2025-05-13 · Updated 2026-01-22 · CVE-2025-32057

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nissan Leaf ZE1 – 2020

Description The Infotainment ECU manufactured by Bosch, used in Nissan Leaf ZE1 vehicles from 2020, utilizes a Redbend service for over-the-air provisioning and updates via HTTPS. The system’s SSL engine uses a default configuration that does not verify the server root certificate. This allows an attacker to potentially impersonate a Redbend backend server using a self-signed certificate.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2025-32057

Affected Products

Infotainment System Ecu

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-32057 · Security Note
• https://nissan.co.uk/vehicles/new-vehicles/leaf.html · Note
• https://twitter.com/CVEnew/status/2014366265704317311 · Twitter Post
• http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf · Note
• https://t.me/purp_sec/618 · Telegram Post
• https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch · Note