What is CVE-2023-28904?

CVE-2023-28904 is a medium-severity vulnerability in Preh Car Connect Gmbh (Joynext Gmbh) Volkswagen Mib3 Infotainment System Oi Mqb, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 5.2/10. Published 2025-06-28.

How severe is CVE-2023-28904?

Medium severity. CVSS v3 base score is 5.2 out of 10.

Buffer overflow in Preh Car Connect Gmbh (Joynext Gmbh) Volkswagen Mib3 Infotainment System Oi Mqb

CVE-2023-28904

A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical access to the MIB3 ECU to bypass firmware signature verification and run arbitrary code in the infotainment system at boot process.

Vulnerability class: Buffer Overflow

EPSS: 0.003 (22.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.2 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N.

Affected products

Preh Car Connect Gmbh (Joynext Gmbh) Volkswagen Mib3 Infotainment System Oi Mqb — versions 0

Weakness classification (CWE)

CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow)

References

cve@asrg.io
cve@asrg.io (technical-description)
cve@asrg.io (third-party-advisory)

Frequently asked questions

What is CVE-2023-28904?: CVE-2023-28904 is a medium-severity vulnerability in Preh Car Connect Gmbh (Joynext Gmbh) Volkswagen Mib3 Infotainment System Oi Mqb, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 5.2/10. Published 2025-06-28.
How severe is CVE-2023-28904?: Medium severity. CVSS v3 base score is 5.2 out of 10.