What is CVE-2023-28901?

CVE-2023-28901 is a medium-severity vulnerability in Skoda Auto Connect, classified under Information Disclosure. CVSS score: 5.3/10. Published 2024-01-18.

How severe is CVE-2023-28901?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Information disclosure in Skoda Auto Connect

CVE-2023-28901

The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumption, average and maximum speed, and other information of Skoda Connect service users by specifying an arbitrary vehicle VIN number.

Vulnerability class: Information Disclosure

Published 2024-01-18 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.005 (41.1th percentile), scored 2026-10-03.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 41st percentile — 41.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000

Affected products

Skoda Auto Connect — versions 0
Skoda-Auto Skoda Connect

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

asrg.io/security-advisories/cve-2023-28901/ (Third Party Advisory)

Frequently asked questions

What is CVE-2023-28901?: CVE-2023-28901 is a medium-severity vulnerability in Skoda Auto Connect, classified under Information Disclosure. CVSS score: 5.3/10. Published 2024-01-18.
How severe is CVE-2023-28901?: Medium severity. CVSS v3 base score is 5.3 out of 10.