CVE-2024-6348 Predictable seed generation after ECU reset
Attackers can bypass security access controls in Nissan Altima Blind Spot Protection Sensors by predicting seeds after ECU resets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6348?
CVE-2024-6348 is a medium-severity vulnerability in Nissan Altima, published on 19 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Predictable seed generation in the security access mechanism of UDS in the Blind Spot Protection Sensor ECU in Nissan Altima (2022) allows attackers to predict the requested seeds and bypass security controls via repeated ECU resets and seed requests.
Weakness: CWE-330
Which versions are affected by CVE-2024-6348?
It affects 1 product.
Products include Nissan-Global Blind Spot Protection Sensor Ecu Firmware.
How do I fix CVE-2024-6348?
No fix has been published for CVE-2024-6348 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-6348 being exploited?
There is no known exploitation of CVE-2024-6348 in the wild and no public exploit code.
Sources
Also known as GHSA-qp2p-3fr2-8j54.