Skip to content
CVE PROGRAM SOURCE RECORD3.3 Low

CVE-2023-28896

Weak encoding for password in UDS services

Description

Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controller Area Network (CAN) bus in a form that can be easily decoded by attackers with physical access to the vehicle. Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

JOYNEXT MIB3 Infotainment Unit

Default version status: unaffected

  • 0 to ≤ 0304affected

References