Integer Overflow Vulnerability in MIB3 Infotainment System by Volkswagen
CVE-2023-28908

5.4MEDIUM

Key Information:

Vendor

Preh Car Connect Gmbh (joynext Gmbh)

Status
Volkswagen Mib3 Infotainment System Mib3 Oi MQb
Vendor
CVE Published:
28 June 2025

What is CVE-2023-28908?

A vulnerability exists within the Bluetooth stack of the MIB3 infotainment system due to insufficient validation of user-supplied data. This flaw can lead to an integer overflow condition when handling non-fragmented HCI packets, potentially allowing unauthorized access or manipulation of system functionalities. Initially identified in the Skoda Superb III model, this issue affects various MIB3 infotainment units, emphasizing the need for urgent security assessments and updates.

Affected Version(s)

Volkswagen MIB3 infotainment system MIB3 OI MQB 0 <= 0304

References

https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishc...
https://pcacybersecurity.com/resources/advisory/vulnerabi...
technical-description
https://asrg.io/security-advisories/vulnerabilities-in-vo...
third-party-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mikhail Evdokimov from PCA Cyber Security (PCAutomotive)
.
CVE-2023-28908 : Integer Overflow Vulnerability in MIB3 Infotainment System by Volkswagen