CVE-2023-28901
Last modified
CVE-2023-28901 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumption, average and maximum speed, and other information of Skoda Connect service users by specifying an arbitrary vehicle VIN number.. EPSS estimates a 0.51% chance of exploitation in the next 30 days.
Description
The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumption, average and maximum speed, and other information of Skoda Connect service users by specifying an arbitrary vehicle VIN number.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Skoda-Auto | Skoda Connect | All versions |
References
- https://asrg.io/security-advisories/cve-2023-28901/Third Party Advisory
- https://asrg.io/security-advisories/cve-2023-28901/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-28901?
How severe is CVE-2023-28901?
How do I fix CVE-2023-28901?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-28895The password for access to the debugging console of the PoWe…6.8
- CVE-2023-28896Access to critical Unified Diagnostics Services (UDS) of the…2.4
- CVE-2023-28897The secret value used for access to critical UDS services of…9.8
- CVE-2023-28898The Real-Time Streaming Protocol implementation in the MIB3 …5.3
- CVE-2023-28899By sending a specific reset UDS request via OBDII port of Sk…5.5
- CVE-2023-28900The Skoda Automotive cloud contains a Broken Access Control …5.3
- CVE-2023-28902An integer underflow in the image processing binary of the M…3.3
- CVE-2023-28903An integer overflow in the image processing binary of the MI…3.3
- CVE-2023-28904A logic flaw leading to a RAM buffer overflow in the bootloa…5.2
- CVE-2023-28905A heap buffer overflow in the image processing binary of the…8
- CVE-2023-28906A command injection in the networking service of the MIB3 in…7.8
- CVE-2023-28907There is no memory isolation between CPU cores of the MIB3 i…6.7
Are you affected by CVE-2023-28901?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST