CVE-2024-8358 Visteon Infotainment UPDATES_ExtractFile Command Injection Remote Code Execution Vulnerability

Medium 6.8 Published 22 Nov 2024 Updated 25 Nov 2024

Physically present attackers can execute arbitrary code on Visteon Infotainment systems via a crafted update file triggering command injection.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-8358?

CVE-2024-8358 is a medium-severity command injection vulnerability in Visteon Infotainment, published on 22 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Visteon Infotainment UPDATES_ExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the UPDATES_ExtractFile function. A crafted software update file can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23422.

Weakness: CWE-78

Which versions are affected by CVE-2024-8358?

It affects 1 product.

Products include Visteon Infotainment.

How do I fix CVE-2024-8358?

No fix has been published for CVE-2024-8358 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-8358 being exploited?

There is no known exploitation of CVE-2024-8358 in the wild and no public exploit code.

Sources

Also known as GHSA-mq9q-3729-crjx.