CVE-2015-5611

Severity: high (CVSS 8.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-07-21 · updated 2026-06-17

Description

Unspecified vulnerability in Uconnect before 15.26.1, as used in certain Fiat Chrysler Automobiles (FCA) from 2013 to 2015 models, allows remote attackers in the same cellular network to control vehicle movement, cause human harm or physical damage, or modify dashboard settings via vectors related to modification of entertainment-system firmware and access of the CAN bus due to insufficient "Radio security protection," as demonstrated on a 2014 Jeep Cherokee Limited FWD.

Affected products

Fca Uconnect: through 15.26.1

References

http://blog.fcanorthamerica.com/2015/07/22/unhacking-the-hacked-jeep/
http://media.fcanorthamerica.com/newsrelease.do?id=16827&mid=1
http://www-odi.nhtsa.dot.gov/acms/cs/jaxrs/download/doc/UCM483033/RCAK-15V461-4967.pdf
http://www-odi.nhtsa.dot.gov/acms/cs/jaxrs/download/doc/UCM483036/RCLRPT-15V461-9407.pdf
http://www.securityfocus.com/bid/75993
http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
https://ics-cert.us-cert.gov/advisories/ICSA-15-260-01
https://twitter.com/0xcharlie/status/623171594349842433
https://twitter.com/0xcharlie/status/623195051296993280
https://twitter.com/0xcharlie/status/623258479730552832
https://www.youtube.com/watch?v=MK0SrxBC1xs&feature=youtu.be
http://blog.fcanorthamerica.com/2015/07/22/unhacking-the-hacked-jeep/

Get alerted when CVE-2015-5611 or the next vulnerability affects your stack