CVE-2020-27524 Information disclosure in n/a
A format string vulnerability in the Audi A7 MMI Bluetooth stack allows attackers to leak memory content and crash services via a malicious device name.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-27524?
CVE-2020-27524 is a high-severity vulnerability in n/a, published on 11 Nov 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
On Audi A7 MMI 2014 vehicles, the Bluetooth stack in Audi A7 MMI Multiplayer with version (N+R_CN_AU_P0395) mishandles %x and %s format string specifiers in a device name. This may lead to memory content leaks and potentially crash the services.
Weakness: CWE-134
Which versions are affected by CVE-2020-27524?
It affects 1 product.
Products include Audi Mmi Multiplayer.
How do I fix CVE-2020-27524?
No fix has been published for CVE-2020-27524 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-27524 being exploited?
There is no known exploitation of CVE-2020-27524 in the wild and no public exploit code.
Sources
Also known as GHSA-cw9m-x55v-h5jw.