Vulnerability in Preh Car Connect Gmbh (Joynext Gmbh) Volkswagen Mib3 Infotainment System Oi Mqb
CVE-2023-28907
There is no memory isolation between CPU cores of the MIB3 infotainment. This fact allows an attacker with access to the main operating system to compromise the CPU core responsible for CAN message processing. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
EPSS: 0.002 (9.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- cve@asrg.io
- cve@asrg.io (technical-description)
- cve@asrg.io (third-party-advisory)
Frequently asked questions
- What is CVE-2023-28907?
- CVE-2023-28907 is a medium-severity vulnerability in Preh Car Connect Gmbh (Joynext Gmbh) Volkswagen Mib3 Infotainment System Oi Mqb, classified under Improper Access Control. CVSS score: 6.7/10. Published 2025-06-28.
- How severe is CVE-2023-28907?
- Medium severity. CVSS v3 base score is 6.7 out of 10.