Preh Car Connect Volkswagen MIB3 Infotainment System MIB3 OI MQB up to 0304 Image heap-based overflow

Summaryinfo

A vulnerability was found in Preh Car Connect Volkswagen MIB3 Infotainment System MIB3 OI MQB up to 0304. It has been classified as critical. The affected element is an unknown function of the component Image Handler. The manipulation leads to heap-based overflow. This vulnerability is referenced as CVE-2023-28905. The attack needs to be initiated within the local network. No exploit is available.

Detailsinfo

A vulnerability was found in Preh Car Connect Volkswagen MIB3 Infotainment System MIB3 OI MQB up to 0304 and classified as critical. This issue affects an unknown code block of the component Image Handler. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.

The weakness was published by Artem Ivachev. It is possible to read the advisory at i.blackhat.com. The identification of this vulnerability is CVE-2023-28905 since 03/27/2023. The exploitation is known to be easy. Access to the local network is required for this attack. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/01/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-32525). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Preh Car Connect

Name

• Volkswagen MIB3 Infotainment System MIB3 OI MQB

Version

• 0304

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion