Vulnerability · Published Nov 22, 2024 · Assigned by zdi

CVE-2024-8355Visteon Infotainment System DeviceManager iAP Serial Number SQL Injection Vulnerability

Medium 6.8

In plain English

A medium-severity SQL injection in Infotainment from Visteon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.0)6.8Medium

Exploit odds (30 days)0.6%top 53.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Visteon Infotainment System DeviceManager iAP Serial Number SQL Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment system. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DeviceManager. When parsing the iAP Serial number, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20112.

Affected products (as reported)

Vendor	Product	Versions
Visteon	Infotainment	74.00.311A

Weakness: CWE-89 · Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

ZDI-24-1208 x_research-advisory