CVE-2020-8539

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker to inject commands to generate CAN frames that are sent into the M-CAN bus (Multimedia CAN bus) of the vehicle.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/gianpyc/4dc8b0d0c29774a10a97785711e325c3Third Party Advisory
https://sowhat.iit.cnr.it/pdf/IIT-20-2020.pdfExploit, Third Party Advisory
https://gist.github.com/gianpyc/4dc8b0d0c29774a10a97785711e325c3Third Party Advisory
https://sowhat.iit.cnr.it/pdf/IIT-20-2020.pdfExploit, Third Party Advisory

Timeline

Published: Dec 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-85409.8An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated CVE-2020-85416.5OX App Suite through 7.10.3 allows XXE attacks.CVE-2020-85425.4OX App Suite through 7.10.3 allows XSS.CVE-2020-85437.5OX App Suite through 7.10.3 has Improper Input Validation.CVE-2020-85446.5OX App Suite through 7.10.3 allows SSRF.CVE-2020-85457.5Global.py in AIL framework 2.8 allows path traversal.CVE-2020-85479.8phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes tha CVE-2020-85486.1massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences CVE-2020-85496.1Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stea CVE-2020-85516.5The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service att CVE-2020-85524.3The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denia CVE-2020-85535.9The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create in