Vulnerability · Published Dec 1, 2020 · Assigned by mitre

CVE-2020-8539

High 7.8

In plain English

A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.

Severity (CVSS NVD)7.8High

Exploit odds (30 days)2.3%top 16.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Metasploit

Official description

Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker to inject commands to generate CAN frames that are sent into the M-CAN bus (Multimedia CAN bus) of the vehicle.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://sowhat.iit.cnr.it/pdf/IIT-20-2020.pdf x_refsource_MISC
https://gist.github.com/gianpyc/4dc8b0d0c29774a10a97785711e325c3 x_refsource_MISC