Vulnerability · Published Jan 22, 2026 · Assigned by ASRG

CVE-2025-32057Misconfigured SSL/TLS communication of Redbend service for Infotainment ECU

Medium 6.5

In plain English

A medium-severity improper certificate validation in Infotainment system ECU from Bosch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 77.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Infotainment ECU manufactured by Bosch which is installed in Nissan Leaf ZE1 – 2020 uses a Redbend service for over-the-air provisioning and updates. HTTPS is used for communication with the back-end server. Due to usage of the default configuration for the underlying SSL engine, the server root certificate is not verified. As a result, an attacker may be able to impersonate a Redbend backend server using a self-signed certificate. First identified on Nissan Leaf ZE1 manufactured in 2020.

Affected products (as reported)

Vendor	Product	Versions
Bosch	Infotainment system ECU	283C30861E

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

https://www.nissan.co.uk/vehicles/new-vehicles/leaf.html product
http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf media-coverage
https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch third-party-advisory