CVE-2023-6073: DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECU

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-11-10 · updated 2026-06-17
Weakness: CWE-20

Description

Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls.

Affected products

Volkswagen ID.3: before 3.2 — fixed in 3.2

How to fix

Upgrade to a fixed version: Volkswagen ID.3 3.2. Check the vendor advisory for mitigations.

References

https://asrg.io/cve-2023-6073-dos-and-control-of-volume-settings-for-vw-id-3-icas3-ivi-ecu/
https://asrg.io/cve-2023-6073-dos-and-control-of-volume-settings-for-vw-id-3-icas3-ivi-ecu/

Get alerted when CVE-2023-6073 or the next vulnerability affects your stack