Preh Car Connect Gmbh (Joynext Gmbh) Volkswagen Mib3 Infotainment System Mib3 Oi Mqb
12 CVEs affecting Preh Car Connect Gmbh (Joynext Gmbh) Volkswagen Mib3 Infotainment System Mib3 Oi Mqb. Latest disclosed: 2025-06-28. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28910 | High | 8.0 | 2025-06-28 | A specific flaw exists within the Bluetooth stack of the MIB3 infotainment system. The issue results from the disabled abortion flag eventually leading to bypa… |
CVE-2023-28909 | High | 8.0 | 2025-06-28 | A specific flaw exists within the Bluetooth stack of the MIB3 unit. The issue results from the lack of proper validation of user-supplied data, which can resul… |
CVE-2023-28905 | High | 8.0 | 2025-06-28 | A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it. The vulnerability was o… |
CVE-2023-28906 | High | 7.8 | 2025-06-28 | A command injection in the networking service of the MIB3 infotainment allows an attacker already presenting in the system to escalate privileges and obtain ad… |
CVE-2023-28907 | Medium | 6.7 | 2025-06-28 | There is no memory isolation between CPU cores of the MIB3 infotainment. This fact allows an attacker with access to the main operating system to compromise th… |
CVE-2023-28911 | Medium | 6.5 | 2025-06-28 | A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-supplied data, which c… |
CVE-2023-29113 | Medium | 6.3 | 2025-06-28 | The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication… |
CVE-2023-28912 | Medium | 5.7 | 2025-06-28 | The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical acc… |
CVE-2023-28908 | Medium | 5.4 | 2025-06-28 | A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-supplied data, which c… |
CVE-2023-28904 | Medium | 5.2 | 2025-06-28 | A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical access to the MIB3 ECU… |
CVE-2023-28903 | Low | 3.3 | 2025-06-28 | An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause a denial-of-servi… |
CVE-2023-28902 | Low | 3.3 | 2025-06-28 | An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-servic… |