CVE-2023-34402

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-34402
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside file is encapsulate another file, which service will drop during processing. Due to missed checks, attacker can achieve Arbitrary File Write with service speech rights.

7.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://securelist.com/mercedes-benz-head-unit-security-research/115218/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mercedes-benz:headunit_ntg6_mercedes-benz_user_experience:*:*:*:*:*:*:*:*
History

27 Jun 2025, 16:12

Type Values Removed Values Added
References () https://securelist.com/mercedes-benz-head-unit-security-research/115218/ - () https://securelist.com/mercedes-benz-head-unit-security-research/115218/ - Third Party Advisory
CPE cpe:2.3:a:mercedes-benz:headunit_ntg6_mercedes-benz_user_experience:*:*:*:*:*:*:*:*
First Time Mercedes-benz
Mercedes-benz headunit Ntg6 Mercedes-benz User Experience

14 Mar 2025, 18:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.7
CWE CWE-787

18 Feb 2025, 18:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.7 		v2 : unknown
v3 : unknown
CWE CWE-787
Summary
  • (es) La unidad principal NTG6 de Mercedes-Benz contiene funciones para importar o exportar configuraciones de perfil a través de USB. Dentro del archivo se encapsula otro archivo, que el servicio descartará durante el procesamiento. Debido a las comprobaciones omitidas, el atacante puede lograr una escritura arbitraria de archivo con derechos de voz del servicio.

14 Feb 2025, 17:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.7
CWE CWE-787

13 Feb 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-13 23:15

Updated : 2025-06-27 16:12

NVD link : CVE-2023-34402

Mitre link : CVE-2023-34402

CVE.ORG link : CVE-2023-34402

JSON object : View

Products Affected

mercedes-benz

  • headunit_ntg6_mercedes-benz_user_experience
CWE
CWE-787

Out-of-bounds Write