CVE-2023-28901

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumption, average and maximum speed, and other information of Skoda Connect service users by specifying an arbitrary vehicle VIN number.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Skoda Auto	Skoda Connect	0

References

https://asrg.io/security-advisories/cve-2023-28901/Third Party Advisory
https://asrg.io/security-advisories/cve-2023-28901/Third Party Advisory

Timeline

Published: Jan 18, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-289023.3An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cau CVE-2023-289033.3An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to caus CVE-2023-289045.2A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical acc CVE-2023-289058.0A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it. The CVE-2023-289067.8A command injection in the networking service of the MIB3 infotainment allows an attacker already presenting in the system to escalate privi CVE-2023-289076.7There is no memory isolation between CPU cores of the MIB3 infotainment. This fact allows an attacker with access to the main operating syst CVE-2023-289085.4A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-sup CVE-2023-289098.0A specific flaw exists within the Bluetooth stack of the MIB3 unit. The issue results from the lack of proper validation of user-supplied da CVE-2023-28914.3The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis CVE-2023-289108.0A specific flaw exists within the Bluetooth stack of the MIB3 infotainment system. The issue results from the disabled abortion flag eventua CVE-2023-289116.5A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-sup CVE-2023-289125.7The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the sys