Radu Motspan

**Name of the Vulnerable Software and Affected Versions** Sony XAV-AX8500 (affected versions not specified) **Description** The issue is related to a heap-based buffer overflow in the Bluetooth AVCTP protocol, which can lead to remote code execution. This was demonstrated at Pwn2Own. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sony XAV-AX8500 (affected versions not specified) **Description** The issue is related to an integer overflow in the Bluetooth SDP protocol, which can lead to remote code execution. This was demonstrated at Pwn2Own. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sony XAV-AX8500 (affected versions not specified) **Description** The issue concerns an improper isolation authentication bypass vulnerability in the Bluetooth functionality. It was discovered by Mikhail Evdokimov from PCAutomotive. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bosch Infotainment ECU versions (affected versions not specified) **Description** The Infotainment ECU, manufactured by Bosch, utilizes an RH850 module for CAN communication. The RH850 module connects to the infotainment system via the INC interface and a custom protocol. A flaw in the processing of requests through this protocol on the RH850 side allows an attacker who has code execution on the infotainment main SoC to achieve code execution on the RH850 module. Successful exploitation enables the attacker to send arbitrary CAN messages over the connected CAN bus. This issue was initially identified on the Nissan Leaf ZE1 manufactured in 2020. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nissan Leaf ZE1 – 2020 **Description** The Infotainment ECU manufactured by Bosch, used in Nissan Leaf ZE1 vehicles from 2020, utilizes a Redbend service for over-the-air provisioning and updates via HTTPS. The system’s SSL engine uses a default configuration that does not verify the server root certificate. This allows an attacker to potentially impersonate a Redbend backend server using a self-signed certificate. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BOSCH Infotainment ECU (affected versions not specified) **Description** A misconfiguration exists within the Infotainment ECU manufactured by BOSCH. This issue occurs during the startup phase of a specific systemd service, leading to the activation of developer features, including a disabled firewall and a launched SSH server. The vulnerability was initially identified on a Nissan Leaf ZE1 manufactured in 2020. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Alpine iLX-507 (affected versions not specified) **Description** A stack-based buffer overflow vulnerability exists in the Apple CarPlay protocol implementation of the Alpine iLX-507. This flaw allows a physically present attacker to execute arbitrary code on affected devices without authentication. The vulnerability is due to insufficient validation of user-supplied data length before copying it into a fixed-length stack-based buffer, potentially leading to code execution in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior **Description** The issue is related to memory corruption in the web interface, which can be exploited by a remote attacker to cause a denial of service. This is due to a buffer overflow in memory. **Recommendations** For Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior, update to a version later than 1.6 Build 17100315 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moxa OnCell G3100-HSPA Series version 1.5 Build 17042015 **Description** The issue is related to memory corruption in the web interface of the affected device. It is also described as an uncontrolled resource consumption vulnerability in the web interface of the Moxa OnCell G3100-HSPA Series. Exploitation of this issue may allow a remote attacker to execute arbitrary code. **Recommendations** For Moxa OnCell G3100-HSPA Series version 1.5 Build 17042015, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moxa OnCell G3100-HSPA Series versions 1.4 Build 16062919 and prior **Description** A Reliance on Cookies without Validation and Integrity Checking issue allows an attacker to bypass authentication by performing a brute force attack on a cookie parameter that can consist of only digits, gaining access to device functions. **Recommendations** For Moxa OnCell G3100-HSPA Series versions 1.4 Build 16062919 and prior, consider restricting access to the device until a fix is available, and avoid using the cookie parameter for authentication purposes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moxa OnCell G3100-HSPA Series versions 1.4 Build 16062919 and prior **Description** A NULL Pointer Dereference issue was discovered, allowing an attacker to perform a denial of service attack by exploiting the application's failure to check for a NULL value. **Recommendations** For Moxa OnCell G3100-HSPA Series versions 1.4 Build 16062919 and prior, consider applying a patch or update that addresses the NULL Pointer Dereference issue to prevent denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.