CVE-2023-26245
Severity Score
7.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the version check in order to install any firmware version (e.g., newer, older, or customized). This indirectly allows an attacker to install custom firmware in the IVI system.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-02-21 CVE Reserved
- 2023-04-27 CVE Published
- 2024-08-02 CVE Updated
- 2024-08-02 First Exploit
- 2024-11-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-269: Improper Privilege Management
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://sowhat.iit.cnr.it | Not Applicable |
| URL | Date | SRC |
|---|---|---|
| https://sowhat.iit.cnr.it:8443/can-work/chimaera | 2024-08-02 | |
| https://sowhat.iit.cnr.it:8443/can-work/chimaera/-/blob/main/Report/IIT-01-2023.pdf | 2024-08-02 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Hyundai Search vendor "Hyundai" | Gen5w L In-vehicle Infotainment System Firmware Search vendor "Hyundai" for product "Gen5w L In-vehicle Infotainment System Firmware" | 5w.xxx.s5w_l.001.001.221129 Search vendor "Hyundai" for product "Gen5w L In-vehicle Infotainment System Firmware" and version "5w.xxx.s5w_l.001.001.221129" | - |
Affected
| in | Hyundai Search vendor "Hyundai" | Gen5w L In-vehicle Infotainment System Search vendor "Hyundai" for product "Gen5w L In-vehicle Infotainment System" | - | - |
Safe
|
| Hyundai Search vendor "Hyundai" | Gen5w L In-vehicle Infotainment System Firmware Search vendor "Hyundai" for product "Gen5w L In-vehicle Infotainment System Firmware" | ae_e_pe_eur.s5w_l001.001.211214 Search vendor "Hyundai" for product "Gen5w L In-vehicle Infotainment System Firmware" and version "ae_e_pe_eur.s5w_l001.001.211214" | - |
Affected
| in | Hyundai Search vendor "Hyundai" | Gen5w L In-vehicle Infotainment System Search vendor "Hyundai" for product "Gen5w L In-vehicle Infotainment System" | - | - |
Safe
|