Unauthorized Access to Clear-Text Contact Data in Skoda MIB3 Infotainment Unit

CVE-2023-28912

What is CVE-2023-28912?

The MIB3 infotainment unit in Skoda vehicles has a vulnerability that results in the storage of synchronized phone contact information in clear-text format. This issue enables an attacker, whether through code execution on the device or via physical access, to retrieve sensitive contact data belonging to the vehicle owner. It is critical for users of affected units to assess their security measures and understand the risks associated with this vulnerability. A comprehensive list of affected OEM part numbers can be found in the referenced advisories.

References