CVE-2023-26243
Severity Score
7.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The decryption binary used to decrypt firmware files has an information leak that allows an attacker to read the AES key and initialization vector from memory. An attacker may exploit this to create custom firmware that may be installed in the IVI system. Then, an attacker may be able to install a backdoor in the IVI system that may allow him to control it, if it is connected to the Internet through Wi-Fi.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-02-21 CVE Reserved
- 2023-04-27 CVE Published
- 2024-08-02 CVE Updated
- 2024-08-02 First Exploit
- 2024-11-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-668: Exposure of Resource to Wrong Sphere
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://sowhat.iit.cnr.it | Not Applicable |
| URL | Date | SRC |
|---|---|---|
| https://sowhat.iit.cnr.it:8443/can-work/chimaera | 2024-08-02 | |
| https://sowhat.iit.cnr.it:8443/can-work/chimaera/-/blob/main/Report/IIT-01-2023.pdf | 2024-08-02 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Hyundai Search vendor "Hyundai" | Gen5w L In-vehicle Infotainment System Firmware Search vendor "Hyundai" for product "Gen5w L In-vehicle Infotainment System Firmware" | 5w.xxx.s5w_l.001.001.221129 Search vendor "Hyundai" for product "Gen5w L In-vehicle Infotainment System Firmware" and version "5w.xxx.s5w_l.001.001.221129" | - |
Affected
| in | Hyundai Search vendor "Hyundai" | Gen5w L In-vehicle Infotainment System Search vendor "Hyundai" for product "Gen5w L In-vehicle Infotainment System" | - | - |
Safe
|
| Hyundai Search vendor "Hyundai" | Gen5w L In-vehicle Infotainment System Firmware Search vendor "Hyundai" for product "Gen5w L In-vehicle Infotainment System Firmware" | ae_e_pe_eur.s5w_l001.001.211214 Search vendor "Hyundai" for product "Gen5w L In-vehicle Infotainment System Firmware" and version "ae_e_pe_eur.s5w_l001.001.211214" | - |
Affected
| in | Hyundai Search vendor "Hyundai" | Gen5w L In-vehicle Infotainment System Search vendor "Hyundai" for product "Gen5w L In-vehicle Infotainment System" | - | - |
Safe
|