CVE-2023-29389

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Toyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows physically proximate attackers to drive a vehicle by accessing the control CAN bus after pulling the bumper away and reaching the headlight connector, and then sending forged "Key is validated" messages via CAN Injection, as exploited in the wild in (for example) July 2022.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Apr 5, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-29397.8Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege eCVE-2023-29406.5Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a maliCVE-2023-294007.3Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected CVE-2023-294014.3The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the ContenCVE-2023-294029.8The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program wCVE-2023-294037.8On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in cerCVE-2023-294049.8The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when CVE-2023-294059.8The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when CVE-2023-294066.5The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers oCVE-2023-294076.5A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cauCVE-2023-294086.5The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small iCVE-2023-294095.3Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the