Mib3 Infotainment Unit
Approved changes feed: RSS · Atom
cpe:2.3:a:joynext:mib3_infotainment_unit:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Joynext (2621bc0b-dbc1-5c12-8697-2865b10a3fbb) |
|---|---|
| Product | Mib3 Infotainment Unit (68bbc82d-6c86-5565-9f05-b846aa7b4c62) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-28898 |
vulnerable | 2026-06-08 06:02:36.611622 |
Head Unit Denial-of-Service via Apple CarPlay service
MEDIUM (5.3)
The Real-Time Streaming Protocol implementation in the MIB3 infotainment incorrectly handles requests to /logs URI, when the id parameter equals to zero. This issue allows an attacker connected to the in-vehicle Wi-Fi network to cause denial-of-service of the infotainment system, when the certain preconditions are met.
Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.
Published: 2024-01-12T16:04:57.218Z
Updated: 2024-11-14T15:48:25.166Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28897 |
vulnerable | 2026-06-08 06:02:36.608176 |
Hard-coded password for UDS services
MEDIUM (4)
The secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware.
Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.
Published: 2024-01-12T15:55:00.234Z
Updated: 2025-06-17T21:09:16.817Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28896 |
vulnerable | 2026-06-08 06:02:36.607447 |
Weak encoding for password in UDS services
LOW (3.3)
Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controller Area Network (CAN) bus in a form that can be easily decoded by attackers with physical access to the vehicle.
Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.
Published: 2023-12-01T14:01:05.877Z
Updated: 2024-08-02T13:51:38.819Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28895 |
vulnerable | 2026-06-08 06:02:36.605527 |
Hard-coded password for access to power controller chip memory
LOW (3.5)
The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip.
Vulnerability found on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.
Published: 2023-12-01T13:41:16.581Z
Updated: 2024-12-02T17:48:05.077Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.