What’s Vulnerable › Vulnerabilities

CVE-2023-28895: Hard-coded password for access to power controller chip memory

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-12-01 · updated 2026-06-17
• Weakness: CWE-259

Description

The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.

Affected products

• JOYNEXT MIB3 Infotainment Unit: before 0304 — fixed in 0304

How to fix

Upgrade to a fixed version: JOYNEXT MIB3 Infotainment Unit 0304. Check the vendor advisory for mitigations.

References

• https://asrg.io/security-advisories/hard-coded-password-for-access-to-power-controller-chip-memory/
• https://asrg.io/security-advisories/hard-coded-password-for-access-to-power-controller-chip-memory/

Get alerted when CVE-2023-28895 or the next vulnerability affects your stack