CVE-2023-34402

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside file is encapsulate another file, which service will drop during processing. Due to missed checks, attacker can achieve Arbitrary File Write with service speech rights.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Feb 13, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-344034.9Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to this pins and get access to inteCVE-2023-344044.9Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to these pins and get access to intCVE-2023-344063.3An issue was discovered on Mercedes Benz NTG 6. A possible integer overflow exists in the user data import/export function of NTG (New TelemCVE-2023-344077.5OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL.CVE-2023-344085.4DokuWiki before 2023-04-04a allows XSS via RSS titles.CVE-2023-344099.8In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalizeCVE-2023-34419.1An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4. The product did not sufficiently warn aboCVE-2023-344105.3An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does noCVE-2023-344117.5The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nestingCVE-2023-344124.8A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticaCVE-2023-344143.1The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialoCVE-2023-344156.1When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that docu
CVE-2023-34402: High severity, CVSS 7.7 | Vulnix