Description

Visteon Infotainment System DeviceManager iAP Serial Number SQL Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment system. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DeviceManager. When parsing the iAP Serial number, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20112.

INFO

Published Date :

2024-11-22T21:32:37.615Z

Last Modified :

2024-11-26T15:38:24.205Z

Source :

zdi
AFFECTED PRODUCTS

The following products are affected by CVE-2024-8355 vulnerability.

Vendors Products
Visteon
  • Infotainment
  • Infotainment Firmware
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-8355.

URL Resource
https://www.zerodayinitiative.com/advisories/ZDI-24-1208/ cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact