PT-2025-27312 · Volkswagen · Mib3

Mikhail Evdokimov · Published 2025-06-28 · Updated 2025-06-30 · CVE-2023-28908

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment (affected versions not specified)

Description: A specific flaw exists within the Bluetooth stack of the MIB3 infotainment, resulting from the lack of proper validation of user-supplied data. This can cause an integer overflow when receiving non-fragmented HCI packets on a channel. The issue was originally discovered in a Skoda Superb III car with an MIB3 infotainment unit OEM part number 3V0035820.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2023-28908

Affected Products

Mib3

References · 8

• 🔥 https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-28908 · Security Note
• https://twitter.com/CVEnew/status/1938988434733015088 · Twitter Post
• https://t.me/cvenotify/127159 · Telegram Post
• https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 · Note
• https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2 · Note
• https://t.me/cvetracker/27312 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1939024743757132037 · Twitter Post