PT-2025-20890 · Bosch · Infotainment System Ecu

Mikhail Evdokimov · Published 2025-05-13 · Updated 2026-02-20 · CVE-2025-32061

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bosch Infotainment ECU (affected versions not specified)

Description A flaw exists in the Bluetooth stack developed by Alps Alpine within the Infotainment ECU manufactured by Bosch. This is due to insufficient validation of user-supplied data, leading to a stack-based buffer overflow when a specific packet is received on the L2CAP channel. Successful exploitation could allow an attacker to achieve remote code execution on the Infotainment ECU with root privileges. The vulnerability was first identified on Nissan Leaf ZE1 vehicles manufactured in 2020.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2025-32061

Affected Products

Infotainment System Ecu

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-32061 · Security Note
• https://twitter.com/cracbot/status/2024801253457555460 · Twitter Post
• https://twitter.com/NewsNerdie/status/2023661484283195750 · Twitter Post
• https://twitter.com/CveFindCom/status/2023792383356191062 · Twitter Post
• https://twitter.com/NewsNerdie/status/2023299074049314921 · Twitter Post
• https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch · Note
• https://nissan.co.uk/vehicles/new-vehicles/leaf.html · Note
• https://twitter.com/TheHackerWire/status/2023547984861163593 · Twitter Post
• https://twitter.com/CVEnew/status/2022994288859021392 · Twitter Post
• http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf · Note
• https://t.me/purp_sec/618 · Telegram Post
• https://t.me/CVEtracker/44753 · Telegram Post
• https://t.me/cveNotify/152055 · Telegram Post