CVE-2023-26244

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppDMClient binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the digital signature check of AppUpgrade and .lge.upgrade.xml files, which are used during the firmware installation process. This indirectly allows an attacker to use a custom version of AppUpgrade and .lge.upgrade.xml files.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269 CWE-863

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://sowhat.iit.cnr.itNot Applicable
https://sowhat.iit.cnr.it:8443/can-work/chimaeraExploit, Third Party Advisory
https://sowhat.iit.cnr.it:8443/can-work/chimaera/-/blob/main/Report/IIT-01-2023.pdfExploit, Third Party Advisory
https://sowhat.iit.cnr.itNot Applicable
https://sowhat.iit.cnr.it:8443/can-work/chimaeraExploit, Third Party Advisory
https://sowhat.iit.cnr.it:8443/can-work/chimaera/-/blob/main/Report/IIT-01-2023.pdfExploit, Third Party Advisory

Timeline

Published: Apr 27, 2023
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-262457.8An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, w CVE-2023-262467.8An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, w CVE-2023-262485.3The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., inf CVE-2023-262497.5Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially causing a denial of s CVE-2023-26258.0A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, havi CVE-2023-262537.5In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read.CVE-2023-262557.5An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By m CVE-2023-262567.5An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By m CVE-2023-262577.5An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon through 2.18.8. Dynamic memory is not CVE-2023-262589.8Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the CVE-2023-26268.8There exists an authentication bypass vulnerability in OpenThread border router devices and implementations. This issue allows unauthenticat CVE-2023-262605.4OXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows session hijacking, leading to partial access of a customer's account by an attac