CVE-2025-32056

MediumCVSS 4.0/10Last modified Jun 17, 2026

Description

The anti-theft protection mechanism can be bypassed by attackers due to weak response generation algorithms for the head unit. It is possible to reveal all 32 corresponding responses by sniffing CAN traffic or by pre-calculating the values, which allow to bypass the protection.

First identified on Nissan Leaf ZE1 manufactured in 2020.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-1241

Affected software

No affected versions have been published.

Timeline

Published: Jan 22, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-320576.5The Infotainment ECU manufactured by Bosch which is installed in Nissan Leaf ZE1 – 2020 uses a Redbend service for over-the-air provisioning CVE-2025-320589.3The Infotainment ECU manufactured by Bosch uses a RH850 module for CAN communication. RH850 is connected to infotainment over the INC interf CVE-2025-320598.8The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue result CVE-2025-32067.5A vulnerability has been found in code-projects Hospital Management System 1.0 and classified as critical. This vulnerability affects unknow CVE-2025-320606.7The system suffers from the absence of a kernel module signature verification. If an attacker can execute commands on behalf of root user (d CVE-2025-320618.8The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue result CVE-2025-320628.8The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue result CVE-2025-320636.8There is a misconfiguration vulnerability inside the Infotainment ECU manufactured by BOSCH. The vulnerability happens during the startup ph CVE-2025-320675.4Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Growth Experiments Extension allows Cross-Site Scripting (XS CVE-2025-320685.4Incorrect Authorization vulnerability in The Wikimedia Foundation Mediawiki - OAuth Extension allows Authentication Bypass.This issue affect CVE-2025-320695.4Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Media Info Extension allows Cross-Site Scripting (X CVE-2025-32077.5A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. This issue affects some unknown