CVE-2023-28904
Bypass of secure boot process
- State
- Published
- Severity
- 5.2 Medium
- Published
- Jun 28, 2025
- Updated
- Jun 30, 2025
- Reserved
- Mar 27, 2023
Description
A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical access to the MIB3 ECU to bypass firmware signature verification and run arbitrary code in the infotainment system at boot process.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.2 Medium | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N | ASRG |
Weaknesses
- CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected Products
| Product | Versions |
|---|---|
Volkswagen MIB3 infotainment system MIB3 OI MQBPreh Car Connect GmbH (JOYNEXT GmbH) |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.