CVE-2023-34399

Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost library. The version of boost library contains vulnerability integer overflow.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://securelist.com/mercedes-benz-head-unit-security-research/115218/

Configurations

No configuration.

History

24 Mar 2025, 17:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
CWE		CWE-190

18 Feb 2025, 18:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~9.8~~	v2 : unknown v3 : unknown
CWE	~~CWE-190~~

14 Feb 2025, 17:15

Type	Values Removed	Values Added
CWE		CWE-190
Summary		(es) La unidad principal Mercedes-Benz NTG6 contiene funciones para importar o exportar configuraciones de perfil a través de USB. Algunos valores de esta tabla se archivan en serie según la librería Boost. La versión de la librería Boost contiene una vulnerabilidad de desbordamiento de enteros.
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8

13 Feb 2025, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-02-13 22:15

Updated : 2025-03-24 17:15

NVD link : CVE-2023-34399

Mitre link : CVE-2023-34399

CVE.ORG link : CVE-2023-34399

JSON object : View

Products Affected

No product.

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2023-34399", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-02-13T22:15:10.730", "references": [{"url": "https://securelist.com/mercedes-benz-head-unit-security-research/115218/", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost library. The version of boost library contains vulnerability integer overflow."}, {"lang": "es", "value": "La unidad principal Mercedes-Benz NTG6 contiene funciones para importar o exportar configuraciones de perfil a trav\u00e9s de USB. Algunos valores de esta tabla se archivan en serie seg\u00fan la librer\u00eda Boost. La versi\u00f3n de la librer\u00eda Boost contiene una vulnerabilidad de desbordamiento de enteros."}], "lastModified": "2025-03-24T17:15:15.497", "sourceIdentifier": "cve@mitre.org"}

9.8 /10