CVE-2023-34403

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-34403
Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to this pins and get access to internal network. A race condition can be acquired and attacker can spoof “UserData” with desirable file path and access it though backup on USB.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 3.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://securelist.com/mercedes-benz-head-unit-security-research/115218/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mercedes-benz:headunit_ntg6_mercedes-benz_user_experience:*:*:*:*:*:*:*:*
History

27 Jun 2025, 16:12

Type Values Removed Values Added
First Time Mercedes-benz headunit Ntg6 Mercedes-benz User Experience
Mercedes-benz
References () https://securelist.com/mercedes-benz-head-unit-security-research/115218/ - () https://securelist.com/mercedes-benz-head-unit-security-research/115218/ - Third Party Advisory
CPE cpe:2.3:a:mercedes-benz:headunit_ntg6_mercedes-benz_user_experience:*:*:*:*:*:*:*:*

18 Mar 2025, 17:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.9
CWE CWE-284
Summary
  • (es) La unidad principal NTG6 de Mercedes-Benz tiene pines Ethernet en la placa base para conectar el módulo CSB. Un atacante puede conectarse a estos pines y obtener acceso a la red interna. Se puede adquirir una condición de ejecución y el atacante puede falsificar “UserData” con la ruta de archivo deseada y acceder a ella a través de una copia de seguridad en USB.

13 Feb 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-13 23:15

Updated : 2025-06-27 16:12

NVD link : CVE-2023-34403

Mitre link : CVE-2023-34403

CVE.ORG link : CVE-2023-34403

JSON object : View

Products Affected

mercedes-benz

  • headunit_ntg6_mercedes-benz_user_experience
CWE
CWE-284

Improper Access Control