Bluetooth Stack Vulnerability in Volkswagen MIB3 Infotainment System
CVE-2023-28909
8HIGH
Key Information:
- Vendor
- CVE Published:
- 28 June 2025
What is CVE-2023-28909?
A flaw in the Bluetooth stack of Volkswagen's MIB3 infotainment unit arises from inadequate validation of user-supplied data. This weakness can lead to integer overflow when fragmented HCI packets are received on a channel, enabling attackers to bypass MTU checks where fragmentation is enabled. Exploiting this vulnerability could result in a buffer overflow on upper layer profiles, thereby permitting remote code execution. Affected systems include various OEM part numbers, notably the Skoda Superb III unit with part number 3V0035820, raising significant cybersecurity concerns.
Affected Version(s)
Volkswagen MIB3 infotainment system MIB3 OI MQB 0 <= 0304
References
CVSS V3.1
Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Mikhail Evdokimov from PCA Cyber Security (PCAutomotive)