CVE-2023-28904 - CVE House
Back to Database
Status published Medium CVE-2023-28904

Bypass of secure boot process

Vulnerability Description

A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical access to the MIB3 ECU to bypass firmware signature verification and run arbitrary code in the infotainment system at boot process.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-28904

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Danila Parnishchev from PCA Cyber Security (PCAutomotive)
  • Polina Smirnova from PCA Cyber Security (PCAutomotive)

References

More from Preh Car Connect GmbH (JOYNEXT GmbH)

View All →
CVE-2023-29113
A lack of access control in custom IPC mechanism
Medium 6.3
CVE-2023-28912
Cleartext Phonebook Information
Medium 5.7
CVE-2023-28911
Arbitrary Channel Disconnection Resulting in Denial of Service
Medium 6.5
CVE-2023-28910
Disabled Abortion Flag
High 8
CVE-2023-28909
Integer Overflow Leading to MTU Bypass
High 8

Affected Vendor

Preh Car Connect GmbH (JOYNEXT GmbH)

View all reports →

Affected Software

Volkswagen MIB3 infotainment system MIB3 OI MQB
Vulnerable Versions:
0

Timeline

Official Publish: June 28th, 2025
Last Modified: June 30th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Weaknesses (CWE)

CWE-120

MITRE ATT&CK TTPs

T1203 Exploitation for Client Execution
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control