CVE-2023-28895

Severity CVSS v4.0:
Pending analysis
Type:
CWE-798 Use of Hard-coded Credentials
Publication date:
01/12/2023
Last modified:
06/12/2023

Description

The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip.<br /> <br /> Vulnerability found on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:preh:mib3_firmware:*:*:*:*:*:*:*:* 0304 (excluding)
cpe:2.3:h:preh:mib3:-:*:*:*:*:*:*:*