CVE-2024-51074

Sažetak

Incorrect access control in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to arbitrarily change odometer readings in the vehicle by targeting the instrument cluster through the unsecured CAN network. NOTE: this is disputed by the supplier because the CAN bus is not externally exposed, and because the packets can only increase the odometer reading (which typically has no value to an adversary). Also, this is disputed by the Supplier because the findings came from a potentially unrealistic test environment (an isolated ECU part that was not in a vehicle), and because the observed behavior follows the UDS (Unified Diagnostic Services) specification.

Reference

CVSS

Base:	6.7
Impact:	5.3
Exploitability:	0.9

Pristup

Vektor	Složenost	Autentikacija
PHYSICAL	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
LOW	LOW	HIGH

CVSS vektor

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Zadnje važnije ažuriranje

13-01-2025 - 15:15

Objavljeno

22-11-2024 - 16:15