PT-2025-27316 · Mib3 · Mib3

Artem Ivachev + 1 · Published 2025-06-28 · Updated 2025-06-28 · CVE-2023-28912

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: MIB3 unit (affected versions not specified)

Description: The issue concerns the storage of the synchronized phone contact book in clear-text by the MIB3 unit. This allows an attacker with either code execution privilege on the system or physical access to the system to obtain the vehicle owner's contact data. The vulnerability was originally discovered in a Skoda Superb III car with an MIB3 infotainment unit.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2023-28912

Affected Products

Mib3

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-28912 · Security Note
• https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 · Note
• https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2 · Note
• https://twitter.com/VulmonFeeds/status/1939001705099563019 · Twitter Post
• https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf · Note
• https://t.me/cvetracker/27316 · Telegram Post
• https://twitter.com/CVEnew/status/1938988438428209263 · Twitter Post