Lucene search
HistoryNov 10, 2023 - 8:15 a.m.
CVE-2023-6073
volkswagen
icas 3 ivi ecu
denial of service
rest api
volume setting
CVSS3
6.3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
EPSS
0
Percentile
9.0%
Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls.
Affected configurations
Node
volkswagenid.3_firmwareRange<3.2
volkswagenid.3Match-
| Vendor | Product | Version | CPE |
|---|---|---|---|
| volkswagen | id.3_firmware | * | cpe:2.3:o:volkswagen:id.3_firmware:*:*:*:*:*:*:*:* |
| volkswagen | id.3 | - | cpe:2.3:h:volkswagen:id.3:-:*:*:*:*:*:*:* |
Related
prion
prion
Design/Logic Flaw
2023-11-10 08:15:00
cvelist
cvelist
CVE-2023-6073 DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECU
2023-11-10 07:32:16
cve
cve
CVE-2023-6073
2023-11-10 08:15:08
CVSS3
6.3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
EPSS
0
Percentile
9.0%
Related for NVD:CVE-2023-6073