{"id":"CVE-2024-6348","state":"PUBLISHED","title":"Predictable seed generation after ECU reset","description":"Predictable seed generation in the security access mechanism of UDS in the Blind Spot Protection Sensor ECU in Nissan Altima (2022) allows attackers to predict the requested seeds and bypass security controls via repeated ECU resets and seed requests.","publishedAt":"2024-08-19T15:12:25.216Z","updatedAt":"2024-08-19T19:26:54.514Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/V:D/RE:H","source":"ASRG"},"assigner":"ASRG","products":["Nissan Altima"],"affected":[{"vendor":"Nissan","product":"Altima","packageName":"ECU","defaultStatus":"unaffected","versions":[{"version":"Altima 2022","status":"unknown"}],"modules":["Blind Spot Protection Sensor"]}],"references":["https://asrg.io/security-advisories/"],"weaknesses":["CWE-330"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/6xxx/CVE-2024-6348.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-6348","state":"PUBLISHED","datePublished":"2024-08-19T15:12:25.216Z","dateUpdated":"2024-08-19T19:26:54.514Z","assignerShortName":"ASRG","assignerOrgId":"c15abc07-96a9-4d11-a503-5d621bfe42ba","dateReserved":"2024-06-26T10:31:26.483Z"},"containers":{"cna":{"title":"Predictable seed generation after ECU reset","descriptions":[{"lang":"en","value":"Predictable seed generation in the security access mechanism of UDS in the Blind Spot Protection Sensor ECU in Nissan Altima (2022) allows attackers to predict the requested seeds and bypass security controls via repeated ECU resets and seed requests."}],"affected":[{"vendor":"Nissan","product":"Altima","packageName":"ECU","defaultStatus":"unaffected","versions":[{"version":"Altima 2022","status":"unknown"}],"modules":["Blind Spot Protection Sensor"]}],"references":[{"url":"https://asrg.io/security-advisories/"}],"metrics":[{"cvssV4_0":{"Automatable":"YES","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":5.3,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/V:D/RE:H","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"HIGH"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-330","description":"CWE-330: Use of Insufficiently Random Values","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ASRG","orgId":"c15abc07-96a9-4d11-a503-5d621bfe42ba","dateUpdated":"2024-08-19T15:12:25.216Z"},"credits":[{"lang":"en","type":"finder","value":"Thomas Sermpinis"}],"impacts":[{"capecId":"CAPEC-112","descriptions":[{"lang":"en","value":"CAPEC-112: Brute Force - An attacker can use brute force techniques to pre-calculate keys for the known seeds"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-19T19:26:41.720231Z","id":"CVE-2024-6348","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-19T19:26:54.514Z"}}]}}}