CVE-2025-32057 Misconfigured SSL/TLS communication of Redbend service for Infotainment ECU
Attackers can impersonate the backend server due to disabled SSL certificate verification in the default configuration of the Infotainment ECU.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-32057?
CVE-2025-32057 is a medium-severity vulnerability in Bosch Infotainment system ECU, published on 22 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Infotainment ECU manufactured by Bosch which is installed in Nissan Leaf ZE1 – 2020 uses a Redbend service for over-the-air provisioning and updates. HTTPS is used for communication with the back-end server. Due to usage of the default configuration for the underlying SSL engine, the server root certificate is not verified. As a result, an attacker may be able to impersonate a Redbend backend server using a self-signed certificate.
First identified on Nissan Leaf ZE1 manufactured in 2020.
Weakness: CWE-295
Which versions are affected by CVE-2025-32057?
How do I fix CVE-2025-32057?
No fix has been published for CVE-2025-32057 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-32057 being exploited?
There is no known exploitation of CVE-2025-32057 in the wild and no public exploit code.
Sources
Also known as GHSA-w5j8-5p9w-gvx5.