PT-2025-27311 · Volkswagen · Mib3

Artem Ivachev · Published 2025-06-28 · Updated 2025-06-30 · CVE-2023-28907

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment (affected versions not specified)

Description: The issue is related to the lack of memory isolation between CPU cores of the MIB3 infotainment, allowing an attacker with access to the main operating system to compromise the CPU core responsible for CAN message processing. This was originally discovered in a Skoda Superb III car with an MIB3 infotainment unit.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-28907

Affected Products

Mib3

References · 8

• 🔥 https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-28907 · Security Note
• https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 · Note
• https://t.me/cvenotify/126985 · Telegram Post
• https://t.me/cvetracker/27311 · Telegram Post
• https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2 · Note
• https://twitter.com/CVEnew/status/1938988433537671339 · Twitter Post
• https://t.me/cvenotify/127158 · Telegram Post