CVE-2023-28895

The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.

Score

CVSS 3.1 6.8 Medium

Status

Modified - cve@asrg.io

Published

2023-12-01

Last modified

2024-12-02

Weaknesses

CWE-259, CWE-798

Affected products

• Mib3 Infotainment Unit (Joynext)
• Mib3 Firmware (Preh)

References

• https://asrg.io/security-advisories/hard-coded-password-for-access-to-power-controller-chip-memory/