CVE-2023-28901: Trip Data Disclosure from Backend

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-18 · updated 2026-06-17
Weakness: CWE-200

Description

The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumption, average and maximum speed, and other information of Skoda Connect service users by specifying an arbitrary vehicle VIN number.

Affected products

Škoda Auto Škoda Connect: all versions

References

https://asrg.io/security-advisories/cve-2023-28901/
https://asrg.io/security-advisories/cve-2023-28901/

Get alerted when CVE-2023-28901 or the next vulnerability affects your stack