PT-2025-27315 · Volkswagen · Mib3

Mikhail Evdokimov · Published 2025-06-28 · Updated 2025-06-28 · CVE-2023-28911

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment (affected versions not specified)

Description: A specific flaw exists within the Bluetooth stack of the MIB3 infotainment, resulting from the lack of proper validation of user-supplied data. This can lead to an arbitrary channel disconnection, allowing an attacker to cause a denial-of-service attack for every connected client of the infotainment device. The issue was originally discovered in a Skoda Superb III car with an MIB3 infotainment unit.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-28911

Affected Products

Mib3

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-28911 · Security Note
• https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 · Note
• https://t.me/cvetracker/27315 · Telegram Post
• https://twitter.com/CVEnew/status/1938988437580980325 · Twitter Post
• https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2 · Note
• https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf · Note
• https://twitter.com/VulmonFeeds/status/1939011944213520706 · Twitter Post