Visteon Infotainment REFLASH_DDU_ExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the REFLASH_DDU_ExtractFile function. A crafted software update file can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23421.
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
https://www.zerodayinitiative.com/advisories/ZDI-24-1192/ |
History
Wed, 04 Dec 2024 20:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
cvssV3_1
|
Mon, 25 Nov 2024 02:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Visteon
Visteon infotainment |
|
CPEs | cpe:2.3:a:visteon:infotainment:cmu150_na_74.00.324a:*:*:*:*:*:*:* | |
Vendors & Products |
Visteon
Visteon infotainment |
|
Metrics |
ssvc
|
Fri, 22 Nov 2024 21:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | Visteon Infotainment REFLASH_DDU_ExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability. The specific flaw exists within the REFLASH_DDU_ExtractFile function. A crafted software update file can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23421. | |
Title | Visteon Infotainment REFLASH_DDU_ExtractFile Command Injection Remote Code Execution Vulnerability | |
Weaknesses | CWE-78 | |
References |
| |
Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: zdi
Published: 2024-11-22T21:33:32.855Z
Updated: 2024-11-25T01:36:35.700Z
Reserved: 2024-08-30T16:16:19.322Z
Link: CVE-2024-8360
Vulnrichment
Updated: 2024-11-25T01:34:15.141Z
NVD
Status : Analyzed
Published: 2024-11-22T22:15:19.497
Modified: 2024-12-04T19:32:21.703
Link: CVE-2024-8360
Redhat
No data.