PT-2025-20891 · Bosch · Infotainment System Ecu

Mikhail Evdokimov · Published 2025-05-13 · Updated 2026-02-20 · CVE-2025-32062

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bosch Infotainment ECU versions (affected versions not specified)

Description A flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue is due to a lack of proper boundary validation of user-supplied data, which can lead to a stack-based buffer overflow when receiving a specific packet on the established upper layer L2CAP channel. An attacker can exploit this to obtain remote code execution on the Infotainment ECU with root privileges. The issue was first identified on Nissan Leaf ZE1 manufactured in 2020.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2025-32062

Affected Products

Infotainment System Ecu

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-32062 · Security Note
• https://twitter.com/CveFindCom/status/2023701830748774483 · Twitter Post
• https://twitter.com/CVEnew/status/2022994287848206407 · Twitter Post
• https://twitter.com/vuldb/status/2023096762513445219 · Twitter Post
• http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf · Note
• https://t.me/purp_sec/618 · Telegram Post
• https://t.me/cveNotify/152056 · Telegram Post
• https://nissan.co.uk/vehicles/new-vehicles/leaf.html · Note
• https://twitter.com/VulmonFeeds/status/2023006451812151617 · Twitter Post
• https://t.me/CVEtracker/44754 · Telegram Post
• https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch · Note
• https://twitter.com/NewsNerdie/status/2023299074049314921 · Twitter Post
• https://twitter.com/NewsNerdie/status/2023661484283195750 · Twitter Post
• https://twitter.com/TheHackerWire/status/2023548033372389715 · Twitter Post
• https://twitter.com/cracbot/status/2024801255202402659 · Twitter Post