CVE-2023-34399

Published: Feb 13, 2025Modified: Jun 27, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost library. The version of boost library contains vulnerability integer overflow.

Affected (1)

Products: Mercedes Benz: Headunit Ntg6 Mercedes Benz User Experience

Mercedes Benz

1 product

Headunit Ntg6 Mercedes Benz User Experience

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mercedes Benz Headunit Ntg6 Mercedes Benz User Experience	Up to 2021

Related CWEs

CWE-190

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (1)

https://securelist.com/mercedes-benz-head-unit-security-research/115218/

Source: cve@mitre.org

Third Party Advisory

Timeline

No history available yet.