CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 1CVE-2023-6073 – DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECU
https://notcve.org/view.php?id=CVE-2023-6073
Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls. El atacante puede realizar un ataque de Denegación de Servicio para bloquear la ECU ICAS 3 IVI en un Volkswagen ID.3 (y otros vehículos del Grupo VW con el mismo hardware) y falsificar comandos de configuración de volumen para activar irreversiblemente el volumen de audio al máximo a través de llamadas REST API. • https://asrg.io/cve-2023-6073-dos-and-control-of-volume-settings-for-vw-id-3-icas3-ivi-ecu • CWE-20: Improper Input Validation CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1170 – Volkswagen Customer-Link App Protection Mechanism Failure CAN Message Injection Vulnerability
https://notcve.org/view.php?id=CVE-2018-1170
This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen Customer-Link App 1.30 and HTC Customer-Link Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Customer-Link App and Customer-Link Bridge. The issue results from the lack of a proper protection mechanism against unauthorized firmware updates. An attacker can leverage this vulnerability to inject CAN messages. • https://zerodayinitiative.com/advisories/ZDI-18-214 • CWE-693: Protection Mechanism Failure •