CVE-2025-32060: falha de média gravidade em Bosch Infotainment system ECU
Absence of Kernel Module Signature Verification on Linux System of Infotainment ECU
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.7epss 0.1%
The system suffers from the absence of a kernel module signature verification. If an attacker can execute commands on behalf of root user (due to additional vulnerabilities), then he/she is also able to load custom kernel modules to the kernel space and execute code in the kernel context. Such a flaw can lead to taking control over the entire system.
First identified on Nissan Leaf ZE1 manufactured in 2020.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Bosch · Infotainment system ECUCVEs relacionadas — Bosch Infotainment system ECU
No mesmo produto, das mais perigosas para as menos.
CVE-2025-32062HIGHStack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECUEPSS 0.4%CVE-2025-32061HIGHStack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECUEPSS 0.4%CVE-2025-32059HIGHStack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECUEPSS 0.4%CVE-2025-32057MEDIUMMisconfigured SSL/TLS communication of Redbend service for Infotainment ECUEPSS 0.3%CVE-2025-32056MEDIUMAnti-Theft Bypass for Infotainment ECUEPSS 0.3%CVE-2025-32063MEDIUMEnabling SSH server on Infotainment ECUEPSS 0.2%