CVE-2024-37601

An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6. A possible heap buffer overflow exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. With prepared data, an attacker can cause the User-Data service to fail. The failed service instance will restart automatically.

• CWE-122

• https://securelist.com/mercedes-benz-head-unit-security-research/115218/Third Party Advisory

Published

Feb 13, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37574The GriceMobile com.grice.call application 4.5.2 for Android…8.2
• CVE-2024-37575The Mister org.mistergroup.shouldianswer application 1.4.264…7.5
• CVE-2024-3758in OpenHarmony v4.0.0 and prior versions allow a local attac…7.8
• CVE-2024-3759in OpenHarmony v4.0.0 and prior versions allow a local attac…7.8
• CVE-2024-3760In lunary-ai/lunary version 1.2.7, there is a lack of rate l…7.5
• CVE-2024-37600An issue was discovered in Mercedes Benz NTG (New Telematics…6.8
• CVE-2024-37602An issue was discovered in Mercedes Benz NTG (New Telematics…4.6
• CVE-2024-37603An issue was discovered in Mercedes Benz NTG (New Telematics…4.6
• CVE-2024-37605A NULL pointer dereference in D-Link DIR-860L REVB_FIRMWARE_…6.5
• CVE-2024-37606A Stack overflow vulnerability in D-Link DCS-932L REVB_FIRMW…6.5
• CVE-2024-37607A Buffer overflow vulnerability in D-Link DAP-2555 REVA_FIRM…6.5
• CVE-2024-3761In lunary-ai/lunary version 1.2.2, the DELETE endpoint locat…7.5