What’s Vulnerable › Vulnerabilities

CVE-2023-28904: Bypass of secure boot process

• Severity: medium (CVSS 5.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-28 · updated 2026-06-17
• Weakness: CWE-120

Description

A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical access to the MIB3 ECU to bypass firmware signature verification and run arbitrary code in the infotainment system at boot process.

Affected products

• Preh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infotainment system MIB3 OI MQB: through 0304

References

• https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2/
• https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf
• https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2
• https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf

Get alerted when CVE-2023-28904 or the next vulnerability affects your stack