Vulnerability · Published Nov 22, 2024 · Assigned by zdi

CVE-2024-8360Visteon Infotainment REFLASH_DDU_ExtractFile Command Injection Remote Code Execution Vulnerability

Medium 6.8

In plain English

A medium-severity OS command injection in Infotainment from Visteon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.0)6.8Medium

Exploit odds (30 days)0.9%top 40.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Visteon Infotainment REFLASH_DDU_ExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability. The specific flaw exists within the REFLASH_DDU_ExtractFile function. A crafted software update file can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23421.

Affected products (as reported)

Vendor	Product	Versions
Visteon	Infotainment	cmu150_NA_74.00.324A

Weakness: CWE-78 · Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

ZDI-24-1192 x_research-advisory