CVE-2023-6073CWE-20CWE-284

DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECU

Medium · published November 10, 2023

CVSS v3.1
5.7
EPSS
0%
Percentile
32.3
In the wild
Unconfirmed
What it is

Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00393 · 32.3th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-284 · Improper Access Control
Published
2023-11-10T07:32Z
EPSS history
Timeline
  • 10 NOV 07:32Z
    DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECU
    cvelistv5