OpenCVE

Renault Zoe EV 2021 automotive infotainment system versions 283C35202R to 283C35519R (builds 11.10.2021 to 16.01.2023) allows attackers to crash the infotainment system by sending arbitrary USB data via a USB device.

No CVSS v4.0

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Renault	Zoe Ev 2021 Zoe Ev 2021 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:renault:zoe_ev_2021_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:renault:zoe_ev_2021:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://blog.dhjeong.kr/posts/automotive/2023/12/how-to-fuzzing-realcars/
https://blog.dhjeong.kr/posts/vuln/202307/renault-zoe/
https://blog.jhyeon.dev/posts/vuln/202307/renault-zoe/
https://nvd.nist.gov/vuln/detail/CVE-2023-39075

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-08-03T00:00:00

Updated: 2024-08-02T18:02:05.323Z

Reserved: 2023-07-25T00:00:00

Link: CVE-2023-39075

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-08-03T18:15:11.477

Modified: 2024-11-21T08:14:43.520

Link: CVE-2023-39075

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:renault:zoe_ev_2021_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5B85A8D9-2845-447F-9C2E-0623BE0A3C97", "versionEndIncluding": "16.01.2023", "versionStartIncluding": "11.10.2021", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:renault:zoe_ev_2021:-:*:*:*:*:*:*:*", "matchCriteriaId": "4D81BFB6-96A1-46C5-8A70-F4B6F2C403CB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Renault Zoe EV 2021 automotive infotainment system versions 283C35202R to 283C35519R (builds 11.10.2021 to 16.01.2023) allows attackers to crash the infotainment system by sending arbitrary USB data via a USB device."}, {"lang": "es", "value": "Las versiones 283C35202R a 283C35519R del Renault Zoe EV 2021 (compilaciones del 11.10.2021 al 16.01.2023) permiten a los atacantes bloquear el sistema de infoentretenimiento enviando datos USB arbitrarios a trav\u00e9s de un dispositivo USB."}], "id": "CVE-2023-39075", "lastModified": "2024-11-21T08:14:43.520", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-08-03T18:15:11.477", "references": [{"source": "cve@mitre.org", "url": "https://blog.dhjeong.kr/posts/automotive/2023/12/how-to-fuzzing-realcars/"}, {"source": "cve@mitre.org", "url": "https://blog.dhjeong.kr/posts/vuln/202307/renault-zoe/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.jhyeon.dev/posts/vuln/202307/renault-zoe/"}, {"source": "cve@mitre.org", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39075"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://blog.dhjeong.kr/posts/automotive/2023/12/how-to-fuzzing-realcars/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://blog.dhjeong.kr/posts/vuln/202307/renault-zoe/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.jhyeon.dev/posts/vuln/202307/renault-zoe/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39075"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}