Back to Database
Status published
Medium
CVE-2023-6073
DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECU
Vulnerability Description
Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-6073
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Hannah Wieser
- Jannis Hamborg
- Timm Lauser
- Thomas Schäfer
- Christoph Krauß
References
Affected Vendor
Volkswagen
View all reports →Affected Software
ID.3
Vulnerable Versions:
0
Timeline
Official Publish:
November 10th, 2023
Last Modified:
February 27th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H