CVE-2023-28906: Command injection in networking service
A command injection in the networking service of the MIB3 infotainment allows an attacker already presenting in the system to escalate privileges and obtain administrative access to the system. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-28906?
CVE-2023-28906 has a high severity rating due to its potential to allow privilege escalation and administrative access.
How do I fix CVE-2023-28906?
To fix CVE-2023-28906, ensure your MIB3 infotainment system firmware is updated to the latest version provided by Skoda.
Who is affected by CVE-2023-28906?
CVE-2023-28906 affects vehicles equipped with the MIB3 infotainment system, particularly the Skoda Superb III model.
What type of vulnerability is CVE-2023-28906?
CVE-2023-28906 is classified as a command injection vulnerability that can compromise system security.
Can CVE-2023-28906 be exploited remotely?
CVE-2023-28906 requires an attacker to already have access to the system, meaning it cannot be exploited remotely.