CVE-2023-34399
📋 TL;DR
This vulnerability in Mercedes-Benz NTG6 head units allows integer overflow in the Boost library when processing serialized archives via USB profile import/export functions. Attackers could potentially execute arbitrary code on the vehicle's infotainment system. Affects Mercedes-Benz vehicles with NTG6 head units.
💻 Affected Systems
- Mercedes-Benz vehicles with NTG6 head units
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete compromise of the head unit, potentially enabling vehicle system manipulation or data exfiltration.
Likely Case
Local code execution via USB connection, allowing attackers to install malware or access vehicle systems when physical access is obtained.
If Mitigated
Limited impact if USB ports are disabled or access controlled, though the vulnerability remains present in the system.
🎯 Exploit Status
Exploitation requires crafting malicious serialized archives and USB access; no public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with Mercedes-Benz dealership for specific firmware updates
Vendor Advisory: https://securelist.com/mercedes-benz-head-unit-security-research/115218/
Restart Required: Yes
Instructions:
1. Contact authorized Mercedes-Benz dealership. 2. Schedule firmware update for NTG6 head unit. 3. Apply manufacturer-provided patch. 4. Restart vehicle systems to complete installation.
🔧 Temporary Workarounds
Disable USB profile import/export
allDisable USB-based profile import/export functionality if available in vehicle settings
Physical USB port control
allRestrict physical access to USB ports using port locks or covers
🧯 If You Can't Patch
- Disable USB ports entirely if not required for normal operation
- Implement strict physical security controls around vehicle access
🔍 How to Verify
Check if Vulnerable:
Check vehicle head unit firmware version and compare against Mercedes-Benz security bulletinsCheck Version:
Check through vehicle's system settings or dealership diagnostic interfaceVerify Fix Applied:
Verify firmware version has been updated to patched version through dealership diagnostic tools📡 Detection & Monitoring
Log Indicators:
- Unusual USB connection attempts
- Profile import/export failures
- System crashes during USB operations
Network Indicators:
- Unexpected USB device enumeration
- Suspicious USB data transfers
SIEM Query:
Not applicable - primarily physical/local attack vector