sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2024-23928 Pioneer DMH-WT7600NEX Telematics Improper Certificate Validation

Medium 6.5 Published Updated

Network-adjacent attackers can bypass certificate validation in Pioneer telematics to compromise data integrity and potentially execute arbitrary code.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Local or same network only
Victim action needed
Not needed
Fix
None listed

What is CVE-2024-23928?

CVE-2024-23928 is a medium-severity vulnerability in Pioneer DMH-WT7600NEX, published on 31 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of Pioneer DMH-WT7600NEX devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the telematics functionality, which operates over HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

Weakness: CWE-295

Which versions are affected by CVE-2024-23928?

It affects 1 product.

Products include Pioneer Dmh-Wt7600nex Firmware.

How do I fix CVE-2024-23928?

No fix has been published for CVE-2024-23928 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-23928 being exploited?

There is no known exploitation of CVE-2024-23928 in the wild and no public exploit code.

Sources

Also known as GHSA-686q-7454-35qj.

Is CVE-2024-23928 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free