CVE-2025-32063: medium-severity vulnerability in Bosch Infotainment system ECU
Enabling SSH server on Infotainment ECU
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.8epss 0.2%
There is a misconfiguration vulnerability inside the Infotainment ECU manufactured by BOSCH. The vulnerability happens during the startup phase of a specific systemd service, and as a result, the following developer features will be activated: the disabled firewall and the launched SSH server.
First identified on Nissan Leaf ZE1 manufactured in 2020.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Bosch · Infotainment system ECURelated CVEs — Bosch Infotainment system ECU
In the same product, most dangerous first.
CVE-2025-32062HIGHStack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECUEPSS 0.4%CVE-2025-32061HIGHStack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECUEPSS 0.4%CVE-2025-32059HIGHStack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECUEPSS 0.4%CVE-2025-32057MEDIUMMisconfigured SSL/TLS communication of Redbend service for Infotainment ECUEPSS 0.3%CVE-2025-32056MEDIUMAnti-Theft Bypass for Infotainment ECUEPSS 0.3%CVE-2025-32058CRITICALStack Overflow in processing requests over INC interface on RH850 side of Infotainment ECUEPSS 0.2%