CVE-2023-28912: Cleartext Phonebook Information
The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical access to the system to obtain vehicle owner's contact data. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-28912?
CVE-2023-28912 is classified as a high severity vulnerability due to the potential exposure of sensitive contact data.
How do I fix CVE-2023-28912?
To mitigate CVE-2023-28912, update the vehicle's infotainment system firmware to the latest version provided by Skoda.
What are the potential risks associated with CVE-2023-28912?
Potential risks include unauthorized access to the vehicle owner's contact information if the attacker has physical access or code execution capabilities.
Which vehicles are affected by CVE-2023-28912?
CVE-2023-28912 specifically affects the Skoda Superb III model equipped with the MIB3 infotainment system.
Who can exploit CVE-2023-28912?
An attacker with either code execution privilege on the system or physical access to the vehicle can exploit CVE-2023-28912.