PT-2025-27310

CVE-2023-28906

Published

2025-06-28

Updated

2025-07-03

Description by

CVSS 3.1

7.8

High

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment versions (affected versions not specified)

Description: A command injection in the networking service of the MIB3 infotainment allows an attacker already present in the system to escalate privileges and obtain administrative access to the system. The issue was originally discovered in a Skoda Superb III car with an MIB3 infotainment unit.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Artem Ivachev

Mikhail Evdokimov

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers