CVE-2023-28904

MediumCVSS 5.2/10Last modified Jun 17, 2026

Description

A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical access to the MIB3 ECU to bypass firmware signature verification and run arbitrary code in the infotainment system at boot process.

Metrics

CVSS 3.1 5.2/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
Preh Car Connect GmbH (JOYNEXT GmbH)	Volkswagen MIB3 infotainment system MIB3 OI MQB	<= 0304

References

Timeline

Published: Jun 28, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-289058.0A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it. The CVE-2023-289067.8A command injection in the networking service of the MIB3 infotainment allows an attacker already presenting in the system to escalate privi CVE-2023-289076.7There is no memory isolation between CPU cores of the MIB3 infotainment. This fact allows an attacker with access to the main operating syst CVE-2023-289085.4A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-sup CVE-2023-289098.0A specific flaw exists within the Bluetooth stack of the MIB3 unit. The issue results from the lack of proper validation of user-supplied da CVE-2023-28914.3The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis CVE-2023-289108.0A specific flaw exists within the Bluetooth stack of the MIB3 infotainment system. The issue results from the disabled abortion flag eventua CVE-2023-289116.5A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-sup CVE-2023-289125.7The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the sys CVE-2023-28924.3The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis CVE-2023-289297.8Trend Micro Security 2021, 2022, and 2023 (Consumer) are vulnerable to a DLL Hijacking vulnerability which could allow an attacker to use a CVE-2023-28934.3The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to mis