CVE-2023-34402

EPSS 0.03%
Veröffentlicht 13.02.2025 23:15:09
Zuletzt bearbeitet 27.06.2025 16:12:42
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside file is encapsulate another file, which service will drop during processing. Due to missed checks, attacker can achieve Arbitrary File Write with service speech rights.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mercedes-benz ≫ Headunit Ntg6 Mercedes-benz User Experience Version <= 2021

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.03%	0.071

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.7	2.5	5.2	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://securelist.com/mercedes-benz-head-unit-security-research/115218/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-34402

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-34402

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-34402

EUVD