CVE-2023-6073
DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECU
- State
- Published
- Severity
- 5.7 Medium
- Published
- Nov 10, 2023
- Updated
- Feb 27, 2025
- Reserved
- Nov 10, 2023
Description
Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.7 Medium | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | ASRG |
| 3.1 | 5.7 Medium | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | ASRG |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ID.3Volkswagen |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.