CVE-2023-28895 : What You Need to Know

This CVE has been published and updated on December 1, 2023, with a reserved date of March 27, 2023, by the ASRG. The vulnerability involves a hard-coded password in the MIB3 Infotainment Unit, affecting the PREH GMBH vendor.

Understanding CVE-2023-28895

This vulnerability is related to a hard-coded password for access to the Power Controller chip memory in the MIB3 Infotainment Unit, potentially leading to unauthorized access and control.

What is CVE-2023-28895?

The CVE-2023-28895 involves a hard-coded password in the firmware of the MIB3 Infotainment Unit that allows attackers physical access to gain full control over the Power Controller chip, posing a significant security risk.

The Impact of CVE-2023-28895

The impact of this vulnerability, as per CAPEC-37 (Retrieve Embedded Sensitive Data), can result in attackers retrieving sensitive data stored within the Power Controller chip, compromising the security and integrity of the system.

Technical Details of CVE-2023-28895

This section provides detailed technical information about the vulnerability affecting the MIB3 Infotainment Unit.

Vulnerability Description

The vulnerability lies in a hard-coded password within the firmware of the MIB3 Infotainment Unit, enabling unauthorized individuals physical access to exploit the debugging console of the Power Controller chip.

Affected Systems and Versions

The vulnerability affects the MIB3 Infotainment Unit from PREH GMBH with versions less than or equal to 0304, specifically impacting devices like the Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.

Exploitation Mechanism

Attackers with physical access to the MIB3 unit can exploit the hard-coded password to gain full control over the Power Controller chip, potentially leading to unauthorized access and manipulation of the system.

Mitigation and Prevention

It is crucial to take immediate steps to address and prevent the exploitation of CVE-2023-28895 to safeguard the affected systems from potential security risks.

Immediate Steps to Take

Disable or change the hard-coded password in the firmware of the MIB3 Infotainment Unit to prevent unauthorized access.
Implement physical security measures to restrict access to the debugging console of the Power Controller chip.

Long-Term Security Practices

Regularly update the firmware of the MIB3 Infotainment Unit to patch known vulnerabilities and enhance security.
Conduct security audits and assessments to identify and mitigate potential security weaknesses in the system.

Patching and Updates

Stay informed about security advisories and updates from the vendor, PREH GMBH, to ensure timely implementation of patches and fixes to address the CVE-2023-28895 vulnerability.