Filtered by vendor Hyundai Subscriptions
Total 6 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-39373 1 Hyundai 2 Hyundai 2017, Hyundai 2017 Firmware 2024-11-21 7.4 High
 A Hyundai model (2017) - CWE-294: Authentication Bypass by Capture-replay.
CVE-2023-26246 1 Hyundai 2 Gen5w L In-vehicle Infotainment System, Gen5w L In-vehicle Infotainment System Firmware 2024-11-21 7.8 High
An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the digital signature check. This indirectly allows an attacker to install custom firmware in the IVI system.
CVE-2023-26245 1 Hyundai 2 Gen5w L In-vehicle Infotainment System, Gen5w L In-vehicle Infotainment System Firmware 2024-11-21 7.8 High
An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the version check in order to install any firmware version (e.g., newer, older, or customized). This indirectly allows an attacker to install custom firmware in the IVI system.
CVE-2023-26244 1 Hyundai 2 Gen5w L In-vehicle Infotainment System, Gen5w L In-vehicle Infotainment System Firmware 2024-11-21 7.8 High
An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppDMClient binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the digital signature check of AppUpgrade and .lge.upgrade.xml files, which are used during the firmware installation process. This indirectly allows an attacker to use a custom version of AppUpgrade and .lge.upgrade.xml files.
CVE-2023-26243 1 Hyundai 2 Gen5w L In-vehicle Infotainment System, Gen5w L In-vehicle Infotainment System Firmware 2024-11-21 7.8 High
An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The decryption binary used to decrypt firmware files has an information leak that allows an attacker to read the AES key and initialization vector from memory. An attacker may exploit this to create custom firmware that may be installed in the IVI system. Then, an attacker may be able to install a backdoor in the IVI system that may allow him to control it, if it is connected to the Internet through Wi-Fi.
CVE-2022-37418 3 Hyundai, Kia, Nissan 6 Hyundai, Hyundai Firmware, Kia and 3 more 2024-11-21 6.4 Medium
The Remote Keyless Entry (RKE) receiving unit on certain Nissan, Kia, and Hyundai vehicles through 2017 allows remote attackers to perform unlock operations and force a resynchronization after capturing two consecutive valid key fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.