CVE-2023-28896CWE-261

Weak encoding for password in UDS services

Low · published December 1, 2023

CVSS v3.1
3.3
EPSS
0%
Percentile
3.1
In the wild
Unconfirmed
What it is

Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controller Area Network (CAN) bus in a form that can be easily decoded by attackers with physical access to the vehicle.

Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00140 · 3.1th percentile
Weakness
CWE-261 · Weak Encoding for Password
Published
2023-12-01T14:01Z
EPSS history
Timeline
  • 01 DEC 14:01Z
    Weak encoding for password in UDS services
    cvelistv5