CVE-2023-34402 Path traversal in n/a

High 7.7 Published 13 Feb 2025 Updated 14 Mar 2025

An attacker with USB access can achieve arbitrary file write and privilege escalation in the Mercedes-Benz NTG6 head-unit due to missing checks during profile import.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-34402?

CVE-2023-34402 is a high-severity path traversal vulnerability in n/a, published on 13 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside file is encapsulate another file, which service will drop during processing. Due to missed checks, attacker can achieve Arbitrary File Write with service speech rights.

Weakness: CWE-787

Which versions are affected by CVE-2023-34402?

It affects 1 product.

Products include Mercedes-Benz Headunit Ntg6 Mercedes-Benz User Experience.

How do I fix CVE-2023-34402?

No fix has been published for CVE-2023-34402 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-34402 being exploited?

There is no known exploitation of CVE-2023-34402 in the wild and no public exploit code.

Sources

Also known as GHSA-rcq4-h567-5923.