CVE-2023-28897CWE-798

Hard-coded password for UDS services

Medium · published January 12, 2024

CVSS v3.1
4.0
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

The secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware.

Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00312 · 22.8th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2024-01-12T15:55Z
EPSS history
Timeline
  • 12 JAN 15:55Z
    Hard-coded password for UDS services
    cvelistv5