Skip to content
OpenAdvisories
Medium · 4.0 CVE-2023-28897 EUVD-2023-32517GHSA-3wxj-wj2j-9jpg

Hard-coded password for UDS services

Published Jan 12, 2024 · Updated Jun 17, 2025 · Assigned by ASRG

Description

The secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware.

Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.

Affected products

VendorProductAffectedFixed
JOYNEXT MIB3 Infotainment Unit ≤ 0304 —

References