CVE-2024-6245 Default Credentials in ssh service for SmartPlay in Maruti Suzuki
Attackers can access the SmartPlay infotainment system via SSH using default credentials, potentially leading to unauthorized control or data access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-6245?
CVE-2024-6245 is a high-severity vulnerability in Faurecia Clarion Electronics Co., Ltd. SmartPlay, published on 28 Oct 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Use of Default Credentials vulnerability in Maruti Suzuki SmartPlay on Linux (Infotainment Hub modules) allows attacker to try common or default usernames and passwords.The issue was detected on a 2022 Maruti Suzuki Brezza in India Market.
This issue affects SmartPlay: 66T0.05.50.
Weakness: CWE-1392
Which versions are affected by CVE-2024-6245?
How do I fix CVE-2024-6245?
No fix has been published for CVE-2024-6245 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-6245 being exploited?
There is no known exploitation of CVE-2024-6245 in the wild and no public exploit code.
Sources
Also known as GHSA-jf2q-q2v4-h63r.