CVE-2023-34406

Published: Feb 13, 2025Modified: Jun 27, 2025

3.3

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Exploitability: 1.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue was discovered on Mercedes Benz NTG 6. A possible integer overflow exists in the user data import/export function of NTG (New Telematics Generation) 6 head units. To perform this attack, local access to USB interface of the car is needed. With prepared data, an attacker can cause the User-Data service to fail. The failed service instance will restart automatically.

Affected (1)

Products: Mercedes Benz: Headunit Ntg6 Mercedes Benz User Experience

1 product

Headunit Ntg6 Mercedes Benz User Experience

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mercedes Benz Headunit Ntg6 Mercedes Benz User Experience	Up to 2021

Related CWEs

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (1)

https://securelist.com/mercedes-benz-head-unit-security-research/115218/

Source: cve@mitre.org

Third Party Advisory

Timeline

No history available yet.