CVE-2023-40292
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Harman Infotainment version 20190525031613 and later discloses the IP address via CarPlay CTRL packets.
Risk Assessment
The disclosure of the IP address may lead to user privacy violations and increased risk of attacks on vehicle systems.
Recommendation
It is recommended to update the software to the latest version to minimize the risk associated with IP address disclosure.
Other vulnerabilities in Harman Infotainment
See all- CVE-2023-40293Medium
Harman Infotainment version 20190525031613 and later allows command injection via unauthenticated RPC with a D-Bus connection object.
- CVE-2023-40291Medium
Harman Infotainment version 20190525031613 allows root access via SSH over a USB-to-Ethernet dongle using a password that is an internal project name.
Original NVD description (English source)
Harman Infotainment 20190525031613 and later discloses the IP address via CarPlay CTRL packets.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS