Vulnerability · Published Feb 13, 2025 · Assigned by mitre
CVE-2024-37602
Medium 4.6
In plain English
A medium-severity null pointer dereference in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Official description
An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021. A possible NULL pointer dereference in the Apple Car Play function affects NTG 6 head units. To perform this attack, physical access to Ethernet pins of the head unit base board is needed. With a static IP address, an attacker can connect via the internal network to the AirTunes / AirPlay service. With prepared HTTP requests, an attacker can cause the Car Play service to fail.
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:3.1/AC:L/AV:P/A:H/C:N/I:N/PR:N/S:U/UI:N