Daimler Mercedes-Benz C Class AMG Premium Plus c220 BlueTec Bluetooth Stack input validation

Summaryinfo

A vulnerability was found in Daimler Mercedes-Benz C Class AMG Premium Plus c220 BlueTec. It has been rated as critical. Impacted is an unknown function of the component Bluetooth Stack. This manipulation of the argument Device Name with the input %x/%c causes input validation. This vulnerability appears as CVE-2020-16142. The attack requires local access. In addition, an exploit is available. It is recommended that the affected component be replaced with an alternative.

Detailsinfo

A vulnerability classified as critical was found in Daimler Mercedes-Benz C Class AMG Premium Plus c220 BlueTec (Vehicle Software) (version unknown). Affected by this vulnerability is an unknown function of the component Bluetooth Stack. The manipulation of the argument Device Name with the input value %x/%c leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a device name in the COMAND infotainment software.

The weakness was presented 08/25/2020 by Liam B. as Mercedes COMAND Infotainment improper format strings handling as confirmed article (Medium). It is possible to read the advisory at medium.com. The public release was coordinated in cooperation with Daimler. This vulnerability is known as CVE-2020-16142 since 07/29/2020. Attacking locally is a requirement. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known.

A public exploit has been developed by Liam B. and been published immediately after the advisory. It is possible to download the exploit at medium.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 256 days. During that time the estimated underground price was around $5k-$25k.

The problem might be mitigated by replacing the product with as an alternative. The article contains the following remark:

Confirmation that this is felt to not be an issue (...) Mercedes ask if I can await them to make a decision about this So after waiting for a while. I’ve posted it. If anyone does have any further joy, I would greatly appreciate any information about how you’ve done it and what you’ve achieved.

Additional details are provided at twitter.com. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Vehicle Software

Vendor

• Daimler

Name

• Mercedes-Benz C Class AMG Premium Plus c220 BlueTec

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion