CVE-2023-34404

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-34404
Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to these pins and get access to internal network. As a result, by accessing a specific port an attacker can send call request to all registered services in router and achieve command injection vulnerability.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 3.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://securelist.com/mercedes-benz-head-unit-security-research/115218/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mercedes-benz:headunit_ntg6_mercedes-benz_user_experience:2021:*:*:*:*:*:*:*
History

27 Jun 2025, 16:12

Type Values Removed Values Added
CPE cpe:2.3:a:mercedes-benz:headunit_ntg6_mercedes-benz_user_experience:2021:*:*:*:*:*:*:*
References () https://securelist.com/mercedes-benz-head-unit-security-research/115218/ - () https://securelist.com/mercedes-benz-head-unit-security-research/115218/ - Third Party Advisory
First Time Mercedes-benz
Mercedes-benz headunit Ntg6 Mercedes-benz User Experience

17 Mar 2025, 19:15

Type Values Removed Values Added
CWE CWE-284
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.9
Summary
  • (es) La unidad principal NTG6 de Mercedes-Benz tiene pines Ethernet en la placa base para conectar el módulo CSB. Un atacante puede conectarse a estos pines y obtener acceso a la red interna. Como resultado, al acceder a un puerto específico, un atacante puede enviar una solicitud de llamada a todos los servicios registrados en el enrutador y lograr una vulnerabilidad de inyección de comandos.

13 Feb 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-13 23:15

Updated : 2025-06-27 16:12

NVD link : CVE-2023-34404

Mitre link : CVE-2023-34404

CVE.ORG link : CVE-2023-34404

JSON object : View

Products Affected

mercedes-benz

  • headunit_ntg6_mercedes-benz_user_experience
CWE
CWE-284

Improper Access Control