CVE-2023-28899

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

By sending a specific reset UDS request via OBDII port of Skoda vehicles, it is possible to cause vehicle engine shutdown and denial of service of other vehicle components even when the vehicle is moving at a high speed. No safety critical functions affected.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Jan 12, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-289005.3The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing to obtain nicknames and other user identifiers of Skoda CVE-2023-289015.3The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mil CVE-2023-289023.3An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cau CVE-2023-289033.3An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to caus CVE-2023-289045.2A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical acc CVE-2023-289058.0A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it. The CVE-2023-289067.8A command injection in the networking service of the MIB3 infotainment allows an attacker already presenting in the system to escalate privi CVE-2023-289076.7There is no memory isolation between CPU cores of the MIB3 infotainment. This fact allows an attacker with access to the main operating syst CVE-2023-289085.4A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-sup CVE-2023-289098.0A specific flaw exists within the Bluetooth stack of the MIB3 unit. The issue results from the lack of proper validation of user-supplied da CVE-2023-28914.3The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis CVE-2023-289108.0A specific flaw exists within the Bluetooth stack of the MIB3 infotainment system. The issue results from the disabled abortion flag eventua