CVE-2023-28895

LOW

MIB3 Firmware < 0304 - Hard-coded Password for PWC Debugging Console

Title source: llm
STIX 2.1

Description

The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.

References (1)

Core 1

Scores

CVSS v3 3.5
EPSS 0.0031
EPSS Percentile 22.8%
Attack Vector PHYSICAL
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-259 CWE-798
Status published
Products (1)
preh/mib3_firmware < 0304
Published Dec 01, 2023
Tracked Since Feb 18, 2026