Vulnerability · Published Mar 30, 2020 · Assigned by jpcert

CVE-2020-5551

High 8.8

In plain English

A high-severity security flaw in DCU (Display Control Unit) from TOYOTA MOTOR CORPORATION. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).

Severity (CVSS NVD)8.8High

Exploit odds (30 days)1.4%top 27.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Toyota 2017 Model Year DCU (Display Control Unit) allows an unauthenticated attacker within Bluetooth range to cause a denial of service attack and/or execute an arbitrary command. The affected DCUs are installed in Lexus (LC, LS, NX, RC, RC F), TOYOTA CAMRY, and TOYOTA SIENNA manufactured in the regions other than Japan from Oct. 2016 to Oct. 2019. An attacker with certain knowledge on the target vehicle control system may be able to send some diagnostic commands to ECUs with some limited availability impacts; the vendor states critical vehicle controls such as driving, turning, and stopping are not affected.

Affected products (as reported)

Vendor	Product	Versions
TOYOTA MOTOR CORPORATION	DCU (Display Control Unit)	2017 Model Year

References

https://jvn.jp/en/vu/JVNVU99396686/index.html x_refsource_MISC
https://global.toyota/en/newsroom/corporate/32120629.html x_refsource_MISC