CVE-2023-29389

MEDIUM EXPLOITED IN THE WILD

Toyota RAV4 2021 - Unauthenticated CAN Injection via Forged Key Validation Messages

Title source: llm

Exploitation Summary

CVE-2023-29389 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).

Description

Toyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows physically proximate attackers to drive a vehicle by accessing the control CAN bus after pulling the bumper away and reaching the headlight connector, and then sending forged "Key is validated" messages via CAN Injection, as exploited in the wild in (for example) July 2022.

References (2)

Core 2

Core References

Exploit, Third Party Advisory

https://kentindell.github.io/2023/04/03/can-injection/

Issue Tracking

https://news.ycombinator.com/item?id=35452963

Scores

CVSS v3 6.8

EPSS 0.0066

EPSS Percentile 46.7%

Attack Vector PHYSICAL

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

VulnCheck KEV 2023-04-05

InTheWild.io 2023-04-05

CWE

CWE-74

Status published

Products (1)

toyota/rav4_firmware 2021

Published Apr 05, 2023

Tracked Since Feb 18, 2026