Nitinronge91

Name of the Vulnerable Software and Affected Versions: KIA Seltos vehicle instrument cluster software version 1.0 KIA Seltos vehicle instrument cluster hardware version 1.0 Description: The issue allows attackers to cause a Denial of Service (DoS) via ECU reset UDS service. It is noted that the findings came from a potentially unrealistic test environment and the ECUReset specification does not allow a manufacturer to require SecurityAccess and Authentication. Recommendations: For KIA Seltos vehicle instrument cluster software version 1.0, consider disabling the ECU reset UDS service as a temporary workaround until a patch is available. For KIA Seltos vehicle instrument cluster hardware version 1.0, restrict access to the ECU reset functionality to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: KIA Seltos vehicle instrument cluster version 1.0 Description: An issue in the KIA Seltos vehicle instrument cluster allows attackers to control or disrupt CAN communication between the instrument cluster and CAN bus. The findings are disputed by the supplier due to the potentially unrealistic test environment and because the observed behavior follows the UDS specification. Recommendations: For KIA Seltos vehicle instrument cluster version 1.0, consider restricting access to the CAN bus to minimize the risk of exploitation until a patch or official fix is available from the supplier. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: KIA Seltos vehicle instrument cluster version 1.0 Description: The issue concerns incorrect access control in the KIA Seltos vehicle instrument cluster, allowing attackers to change odometer readings by targeting the instrument cluster through the unsecured CAN network. It is noted that the CAN bus is not externally exposed and the packets can only increase the odometer reading, which typically has no value to an adversary. The findings are disputed by the supplier due to the potentially unrealistic test environment and because the observed behavior follows the UDS specification. Recommendations: For KIA Seltos vehicle instrument cluster version 1.0, consider restricting access to the instrument cluster to minimize the risk of exploitation. As a temporary workaround, disabling the ability to modify odometer readings through the CAN network may help until a more permanent solution is available. At the moment, there is no information about a newer version that contains a fix for this issue.