PT-2025-27310 · Volkswagen · Mib3

Artem Ivachev + 1 · Published 2025-06-28 · Updated 2025-07-03 · CVE-2023-28906

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment versions (affected versions not specified)

Description: A command injection in the networking service of the MIB3 infotainment allows an attacker already present in the system to escalate privileges and obtain administrative access to the system. The issue was originally discovered in a Skoda Superb III car with an MIB3 infotainment unit.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-28906

Affected Products

Mib3

References · 10

• 🔥 https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-28906 · Security Note
• https://t.me/cvenotify/127157 · Telegram Post
• https://twitter.com/CVEnew/status/1938988432388452515 · Twitter Post
• https://t.me/cvenotify/126984 · Telegram Post
• https://twitter.com/cracbot/status/1940727265568215237 · Twitter Post
• https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 · Note
• https://t.me/cvetracker/27310 · Telegram Post
• https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2 · Note
• https://twitter.com/VulmonFeeds/status/1939017063927881756 · Twitter Post