Radu Motspan

The issue is related to a heap-based buffer overflow in the Bluetooth AVCTP protocol, which can lead to remote code execution. This was demonstrated at Pwn2Own.

The issue is related to an integer overflow in the Bluetooth SDP protocol, which can lead to remote code execution. This was demonstrated at Pwn2Own.

The issue concerns an improper isolation authentication bypass vulnerability in the Bluetooth functionality. It was discovered by Mikhail Evdokimov from PCAutomotive.

The Infotainment ECU, manufactured by Bosch, utilizes an RH850 module for CAN communication. The RH850 module connects to the infotainment system via the INC interface and a custom protocol. A flaw in the processing of requests through this protocol on the RH850 side allows an attacker who has code execution on the infotainment main SoC to achieve code execution on the RH850 module. Successful exploitation enables the attacker to send arbitrary CAN messages over the connected CAN bus. This issue was initially identified on the Nissan Leaf ZE1 manufactured in 2020.

The Infotainment ECU manufactured by Bosch, used in Nissan Leaf ZE1 vehicles from 2020, utilizes a Redbend service for over-the-air provisioning and updates via HTTPS. The system’s SSL engine uses a default configuration that does not verify the server root certificate. This allows an attacker to potentially impersonate a Redbend backend server using a self-signed certificate.

A misconfiguration exists within the Infotainment ECU manufactured by BOSCH. This issue occurs during the startup phase of a specific systemd service, leading to the activation of developer features, including a disabled firewall and a launched SSH server. The vulnerability was initially identified on a Nissan Leaf ZE1 manufactured in 2020.

A stack-based buffer overflow vulnerability exists in the Apple CarPlay protocol implementation of the Alpine iLX-507. This flaw allows a physically present attacker to execute arbitrary code on affected devices without authentication. The vulnerability is due to insufficient validation of user-supplied data length before copying it into a fixed-length stack-based buffer, potentially leading to code execution in the context of root.

The issue is related to memory corruption in the web interface, which can be exploited by a remote attacker to cause a denial of service. This is due to a buffer overflow in memory.

The issue is related to memory corruption in the web interface of the affected device. It is also described as an uncontrolled resource consumption vulnerability in the web interface of the Moxa OnCell G3100-HSPA Series. Exploitation of this issue may allow a remote attacker to execute arbitrary code.

A Reliance on Cookies without Validation and Integrity Checking issue allows an attacker to bypass authentication by performing a brute force attack on a cookie parameter that can consist of only digits, gaining access to device functions.

A NULL Pointer Dereference issue was discovered, allowing an attacker to perform a denial of service attack by exploiting the application's failure to check for a NULL value.