CVE-2023-34406

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-34406
An issue was discovered on Mercedes Benz NTG 6. A possible integer overflow exists in the user data import/export function of NTG (New Telematics Generation) 6 head units. To perform this attack, local access to USB interface of the car is needed. With prepared data, an attacker can cause the User-Data service to fail. The failed service instance will restart automatically.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://securelist.com/mercedes-benz-head-unit-security-research/115218/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mercedes-benz:headunit_ntg6_mercedes-benz_user_experience:*:*:*:*:*:*:*:*
History

27 Jun 2025, 16:12

Type Values Removed Values Added
References () https://securelist.com/mercedes-benz-head-unit-security-research/115218/ - () https://securelist.com/mercedes-benz-head-unit-security-research/115218/ - Third Party Advisory
First Time Mercedes-benz headunit Ntg6 Mercedes-benz User Experience
Mercedes-benz
CPE cpe:2.3:a:mercedes-benz:headunit_ntg6_mercedes-benz_user_experience:*:*:*:*:*:*:*:*

17 Mar 2025, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 3.3
CWE CWE-190
Summary
  • (es) Se descubrió un problema en Mercedes Benz NTG 6. Existe un posible desbordamiento de números enteros en la función de importación/exportación de datos de usuario de las unidades principales NTG (Nueva Generación Telemática) 6. Para realizar este ataque, se necesita acceso local a la interfaz USB del automóvil. Con los datos preparados, un atacante puede provocar que el servicio de datos de usuario falle. La instancia de servicio fallida se reiniciará automáticamente.

13 Feb 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-13 23:15

Updated : 2025-06-27 16:12

NVD link : CVE-2023-34406

Mitre link : CVE-2023-34406

CVE.ORG link : CVE-2023-34406

JSON object : View

Products Affected

mercedes-benz

  • headunit_ntg6_mercedes-benz_user_experience
CWE
CWE-190

Integer Overflow or Wraparound