CVE-2025-32058

Katalog CVE

CVSS 9.3 · Critical EPSS 0,17%

Kerentanan Stack-based Buffer Overflow. Skor CVSS 3.1 9.3 (Critical) menurut asrg.io.

Deskripsi (NVD)

The Infotainment ECU manufactured by Bosch uses a RH850 module for CAN communication. RH850 is connected to infotainment over the INC interface through a custom protocol. There is a vulnerability during processing requests of this protocol on the V850 side which allows an attacker with code execution on the infotainment main SoC to perform code execution on the RH850 module and subsequently send arbitrary CAN messages over the connected CAN bus. First identified on Nissan Leaf ZE1 manufactured in 2020.

Rincian

Terbit di NVD

15 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

9.3 (Critical), sumber asrg.io
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf
• https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch
• https://www.nissan.co.uk/vehicles/new-vehicles/leaf.html