CVE-2023-29113

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication mechanism, leaving attackers with presence in the system an ability to undermine access control restrictions implemented at the operating system level. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jun 28, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-291145.7System logs could be accessed through web management application due to a lack of access control. An attacker can obtain the following sen CVE-2023-291156.5In certain conditions a request directed to the Waybox Enel X Web management application could cause a denial-of-service (e.g. reboot).CVE-2023-291164.3Under certain conditions, through a request directed to the Waybox Enel X web management application, information like Waybox OS version or CVE-2023-291178.8Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system.CVE-2023-291188.8Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.CVE-2023-291198.8Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php.CVE-2023-29127.5Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction.CVE-2023-291208.8Waybox Enel X web management application could be used to execute arbitrary OS commands and provide administrator’s privileges over the Wayb CVE-2023-291218.8Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system.CVE-2023-291226.7Under certain conditions, access to service libraries is granted to account they should not have access to.CVE-2023-291258.0A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700.CVE-2023-291268.8The Waybox Enel X web management application contains a PHP-type juggling vulnerability that may allow a brute force process and under certa