CVE-2025-32056: Anti-Theft Bypass for Infotainment ECU

Severity: medium (CVSS 4.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-22 · updated 2026-06-17
Weakness: CWE-1241

Description

The anti-theft protection mechanism can be bypassed by attackers due to weak response generation algorithms for the head unit. It is possible to reveal all 32 corresponding responses by sniffing CAN traffic or by pre-calculating the values, which allow to bypass the protection. First identified on Nissan Leaf ZE1 manufactured in 2020.

Affected products

Bosch Infotainment system ECU: 283C30861E

References

http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf
https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch
https://www.nissan.co.uk/vehicles/new-vehicles/leaf.html

Get alerted when CVE-2025-32056 or the next vulnerability affects your stack