Artem Ivachev

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment unit (affected versions not specified) Description: The MIB3 infotainment unit used in Skoda and Volkswagen vehicles lacks privilege separation for its proprietary inter-process communication mechanism. This allows attackers with system presence to bypass access control restrictions at the operating system level. The issue was initially found in a Skoda Superb III car with a specific MIB3 infotainment unit. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment unit (affected versions not specified) Description: An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-service of the infotainment system. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: MIB3 Infotainment Unit (affected versions not specified) Description: An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause a denial-of-service of the infotainment system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment unit (affected versions not specified) Description: A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it. The issue was originally discovered in a Skoda Superb III car with an MIB3 infotainment unit. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment versions (affected versions not specified) Description: A command injection in the networking service of the MIB3 infotainment allows an attacker already present in the system to escalate privileges and obtain administrative access to the system. The issue was originally discovered in a Skoda Superb III car with an MIB3 infotainment unit. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment (affected versions not specified) Description: The issue is related to the lack of memory isolation between CPU cores of the MIB3 infotainment, allowing an attacker with access to the main operating system to compromise the CPU core responsible for CAN message processing. This was originally discovered in a Skoda Superb III car with an MIB3 infotainment unit. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: MIB3 unit (affected versions not specified) Description: The issue concerns the storage of the synchronized phone contact book in clear-text by the MIB3 unit. This allows an attacker with either code execution privilege on the system or physical access to the system to obtain the vehicle owner's contact data. The vulnerability was originally discovered in a Skoda Superb III car with an MIB3 infotainment unit. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700.

Under certain conditions, access to service libraries is granted to accounts that should not have access to them. This issue allows unauthorized access to service libraries.

The issue is related to a hardcoded secret value used for access to critical UDS services of the MIB3 infotainment. This hardcoded value is present in the firmware. The vulnerability was discovered in a Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.

Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controller Area Network (CAN) bus in a form that can be easily decoded by attackers with physical access to the vehicle. The vulnerability was discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.

The issue allows a remote attacker to execute unauthorized code by substituting a forged update server, due to the download of code with improper integrity check in snsupd.exe and upd.exe.

The issue allows a local attacker to restore the SysWatch password from the settings database and modify program settings due to the storage of passwords in a recoverable format in the SysWatch service.

The issue arises from an improper check of unusual conditions when launching msiexec.exe in the SysWatch service, allowing a local attacker to bypass a code-signing protection mechanism. This enables the attacker to install or execute an unauthorized program by modifying the system configuration and installing a forged MSI file, contrary to the intended behavior of only allowing installations of MSI files signed by a limited list of certificates.