Back
CVE-2023-28902
Denial of Service via integer underflow in picserver
Low3.3EPSS 0.23%
- Published
- Updated
- Reserved
- Assigned by
- ASRG
Description
An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-service of the infotainment system. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ASRGCNA (assigner) | 3.1 | Low3.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
| NVDNVD · Deferred | 3.1 | Low3.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
- EPSS (exploitation in 30 days)
- 0.23% · top 86% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.3.
Weakness
Affected products
References (3)
- https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf (opens in a new tab)exploit
- https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2 (opens in a new tab)technical-description
- https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2/ (opens in a new tab)third-party-advisory
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-28902)Record last updated .