CVE-2023-29389

Katalog CVE

CVSS 6.8 · Medium EPSS 0,66%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada toyota rav4 firmware. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

Toyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows physically proximate attackers to drive a vehicle by accessing the control CAN bus after pulling the bumper away and reaching the headlight connector, and then sending forged "Key is validated" messages via CAN Injection, as exploited in the wild in (for example) July 2022.

Rincian

Terbit di NVD

5 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://kentindell.github.io/2023/04/03/can-injection/ exploit · advisory pihak ketiga
• https://news.ycombinator.com/item?id=35452963 issue tracking