{"id":"CVE-2025-32056","state":"PUBLISHED","title":"Anti-Theft Bypass for Infotainment ECU","description":"The anti-theft protection mechanism can be bypassed by attackers due to weak response generation algorithms for the head unit. It is possible to reveal all 32 corresponding responses by sniffing CAN traffic or by pre-calculating the values, which allow to bypass the protection.\n\nFirst identified on Nissan Leaf ZE1 manufactured in 2020.","publishedAt":"2026-01-22T15:21:21.945Z","updatedAt":"2026-01-22T15:44:40.651Z","severity":{"score":4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","source":"ASRG"},"assigner":"ASRG","products":["Bosch Infotainment system ECU"],"affected":[{"vendor":"Bosch","product":"Infotainment system ECU","defaultStatus":"unaffected","versions":[{"version":"283C30861E","status":"affected","versionType":"283C30861E"}],"platforms":["Linux"]}],"references":["https://www.nissan.co.uk/vehicles/new-vehicles/leaf.html","http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf","https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch"],"weaknesses":["CWE-1241"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/32xxx/CVE-2025-32056.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-32056","state":"PUBLISHED","datePublished":"2026-01-22T15:21:21.945Z","dateUpdated":"2026-01-22T15:44:40.651Z","assignerShortName":"ASRG","assignerOrgId":"c15abc07-96a9-4d11-a503-5d621bfe42ba","dateReserved":"2025-04-03T15:32:43.280Z"},"containers":{"cna":{"title":"Anti-Theft Bypass for Infotainment ECU","descriptions":[{"lang":"en","value":"The anti-theft protection mechanism can be bypassed by attackers due to weak response generation algorithms for the head unit. It is possible to reveal all 32 corresponding responses by sniffing CAN traffic or by pre-calculating the values, which allow to bypass the protection.\n\nFirst identified on Nissan Leaf ZE1 manufactured in 2020."}],"affected":[{"vendor":"Bosch","product":"Infotainment system ECU","defaultStatus":"unaffected","versions":[{"version":"283C30861E","status":"affected","versionType":"283C30861E"}],"platforms":["Linux"]}],"references":[{"url":"https://www.nissan.co.uk/vehicles/new-vehicles/leaf.html","tags":["product"]},{"url":"http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf","tags":["media-coverage"]},{"url":"https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch","tags":["technical-description"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1241","description":"CWE-1241: Use of Predictable Algorithm in Random Number Generator","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ASRG","orgId":"c15abc07-96a9-4d11-a503-5d621bfe42ba","dateUpdated":"2026-01-22T15:21:21.945Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:bosch:infotainment_system_ecu:283c30861e:*:linux:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"finder","value":"Polina Smirnova (PCA Cyber Security Assessment Team)"}],"impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-22T15:44:24.806159Z","id":"CVE-2025-32056","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-22T15:44:40.651Z"}}]}}}