PT-2025-6655 · Apple+1 · Car Play+1

Published 2025-02-13 · Updated 2025-02-14 · CVE-2024-37602

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mercedes Benz NTG (New Telematics Generation) versions 6 through 2021

Description An issue was discovered in the Apple Car Play function, which can cause a NULL pointer dereference. This issue affects NTG 6 head units. To exploit this, an attacker needs physical access to the Ethernet pins of the head unit base board. With a static IP address, the attacker can connect to the AirTunes / AirPlay service via the internal network. By sending prepared HTTP requests, the attacker can cause the Car Play service to fail.

Recommendations For Mercedes Benz NTG (New Telematics Generation) versions 6 through 2021, as a temporary workaround, consider disabling the Apple Car Play function until a patch is available. Restrict access to the AirTunes / AirPlay service to minimize the risk of exploitation. Avoid using the affected head units with static IP addresses until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2024-37602

Affected Products

Car Play

Mercedes Benz Ntg

References · 6

• https://osv.dev/vulnerability/CVE-2024-37602 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37602 · Security Note
• https://twitter.com/CVEnew/status/1890170593380823490 · Twitter Post
• https://securelist.com/mercedes-benz-head-unit-security-research/115218 · Note
• https://t.me/cvedetector/18048 · Telegram Post
• https://t.me/cvenotify/111330 · Telegram Post