What is CVE-2023-28901?

CVE-2023-28901 is a medium-severity vulnerability in Skoda Auto Connect, classified under Information Disclosure. CVSS score: 5.3/10. Published 2024-01-18.

How severe is CVE-2023-28901?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Information disclosure in Skoda Auto Connect

CVE-2023-28901

The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumption, average and maximum speed, and other information of Skoda Connect service users by specifying an arbitrary vehicle VIN number.

Vulnerability class: Information Disclosure

EPSS: 0.005 (40.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Skoda Auto Connect — versions 0
Skoda-auto Skoda_connect

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@asrg.io (Third Party Advisory)

Frequently asked questions

What is CVE-2023-28901?: CVE-2023-28901 is a medium-severity vulnerability in Skoda Auto Connect, classified under Information Disclosure. CVSS score: 5.3/10. Published 2024-01-18.
How severe is CVE-2023-28901?: Medium severity. CVSS v3 base score is 5.3 out of 10.