Visteon Infotainment UPDATES_ExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the UPDATES_ExtractFile function. A crafted software update file can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23422.
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
https://www.zerodayinitiative.com/advisories/ZDI-24-1190/ |
History
Wed, 11 Dec 2024 04:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
cvssV3_1
|
Mon, 25 Nov 2024 02:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Visteon
Visteon infotainment |
|
CPEs | cpe:2.3:a:visteon:infotainment:cmu150_na_74.00.324a:*:*:*:*:*:*:* | |
Vendors & Products |
Visteon
Visteon infotainment |
|
Metrics |
ssvc
|
Fri, 22 Nov 2024 21:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | Visteon Infotainment UPDATES_ExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPDATES_ExtractFile function. A crafted software update file can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23422. | |
Title | Visteon Infotainment UPDATES_ExtractFile Command Injection Remote Code Execution Vulnerability | |
Weaknesses | CWE-78 | |
References |
| |
Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: zdi
Published: 2024-11-22T21:33:09.888Z
Updated: 2024-11-25T01:43:36.843Z
Reserved: 2024-08-30T16:16:12.024Z
Link: CVE-2024-8358
Vulnrichment
Updated: 2024-11-25T01:36:24.694Z
NVD
Status : Analyzed
Published: 2024-11-22T22:15:19.240
Modified: 2024-12-11T04:00:11.233
Link: CVE-2024-8358
Redhat
No data.