CVE-2023-34401

Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside profile folder there is a file, which is encoded with proprietary UD2 codec. Due to missed size checks in the enapsulate file, attacker can achieve Out-of-Bound Read in heap memory.

• CWE-125

• https://securelist.com/mercedes-benz-head-unit-security-research/115218/Third Party Advisory

Published

Feb 13, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34396Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2023-34397Mercedes Benz head-unit NTG 6 contains functions to import o…7.5
• CVE-2023-34398Mercedes-Benz head-unit NTG6 contains functions to import or…7.5
• CVE-2023-34399Mercedes-Benz head-unit NTG6 contains functions to import or…9.8
• CVE-2023-3440Incorrect Default Permissions vulnerability in Hitachi JP1/P…7.8
• CVE-2023-34400Mercedes-Benz head-unit NTG6 contains functions to import or…7.5
• CVE-2023-34402Mercedes-Benz head-unit NTG6 contains functions to import or…7.7
• CVE-2023-34403Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board…4.9
• CVE-2023-34404Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board…4.9
• CVE-2023-34406An issue was discovered on Mercedes Benz NTG 6. A possible i…3.3
• CVE-2023-34407OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0…7.5
• CVE-2023-34408DokuWiki before 2023-04-04a allows XSS via RSS titles.5.4