{"vulnerability": "CVE-2020-8539", "sightings": [{"uuid": "14ab04c1-b022-4992-84e3-f45f0bf00f06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8539", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "e707b17e-33de-4b88-9352-bd2264554876", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8539", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:31.000000Z"}, {"uuid": "d967a178-ad6b-49ce-8a64-09fd2b8363b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8539", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/android/local/koffee.rb", "content": "", "creation_timestamp": "2021-04-23T13:33:46.000000Z"}, {"uuid": "b7195fec-ffbf-4aa6-a0e6-2d7401284b23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8539", "type": "seen", "source": "https://t.me/cibsecurity/16999", "content": "\u203c CVE-2020-8539 \u203c\n\nKia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker to inject commands to generate CAN frames that are sent into the M-CAN bus (Multimedia CAN bus) of the vehicle.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-01T20:54:10.000000Z"}, {"uuid": "dd37e322-d84c-429d-a805-8224e4c47c7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8539", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/android/local/koffee.rb", "content": "{\"actions\": [{\"description\": \"It hides the parking camera video stream\", \"name\": \"CAMERA_REVERSE_OFF\"}, {\"description\": \"It shows the parking camera video stream\", \"name\": \"CAMERA_REVERSE_ON\"}, {\"description\": \"It changes the cluster language\", \"name\": \"CLUSTER_CHANGE_LANGUAGE\"}, {\"description\": \"It shows radio info in the instrument cluster \", \"name\": \"CLUSTER_RADIO_INFO\"}, {\"description\": \"It shows navigation signals in the instrument cluster \", \"name\": \"CLUSTER_RANDOM_NAVIGATION\"}, {\"description\": \"It shows a round about signal with variable distance in the instrument cluster \", \"name\": \"CLUSTER_ROUNDABOUT_FARAWAY\"}, {\"description\": \"It changes the speed limit shown in the instrument cluster\", \"name\": \"CLUSTER_SPEED_LIMIT\"}, {\"description\": \"It increases the head unit screen brightness\", \"name\": \"HIGH_SCREEN_BRIGHTNESS\"}, {\"description\": \"It injects custom micom payloads\", \"name\": \"INJECT_CUSTOM\"}, {\"description\": \"It pops up a low fuel message on the head unit\", \"name\": \"LOW_FUEL_WARNING\"}, {\"description\": \"It decreases the head unit screen brightness\", \"name\": \"LOW_SCREEN_BRIGHTNESS\"}, {\"description\": \"It sets the radio volume to the max\", \"name\": \"MAX_RADIO_VOLUME\"}, {\"description\": \"It pops up the navigation app window\", \"name\": \"NAVIGATION_FULL_SCREEN\"}, {\"description\": \"It decreases the radio volume\", \"name\": \"REDUCE_RADIO_VOLUME\"}, {\"description\": \"It triggers the seek down radio frequency search\", \"name\": \"SEEK_DOWN_SEARCH\"}, {\"description\": \"It triggers the seek up radio frequency search\", \"name\": \"SEEK_UP_SEARCH\"}, {\"description\": \"It pops up the navigation address window\", \"name\": \"SET_NAVIGATION_ADDRESS\"}, {\"description\": \"It switches off the head unit\", \"name\": \"SWITCH_OFF_HU\"}, {\"description\": \"It switches on the head unit\", \"name\": \"SWITCH_ON_HU\"}, {\"description\": \"It mutes/umutes the radio\", \"name\": \"TOGGLE_RADIO_MUTE\"}], \"aliases\": [], \"arch\": \"\", \"author\": [\"Gianpiero Costantino\", \"Ilaria Matteucci\"], \"autofilter_ports\": null, \"autofilter_services\": null, \"check\": false, \"default_credential\": false, \"description\": \"This module exploits CVE-2020-8539, which is an arbitrary code execution vulnerability that allows an to\\n          attacker execute the micomd binary file on the head unit of Kia Motors. This module has been tested on\\n          SOP.003.30.18.0703, SOP.005.7.181019 and SOP.007.1.191209 head unit software versions. This module, run on an\\n          active session, allows an attacker to send crafted micomd commands that allow the attacker to control the head\\n          unit and send CAN bus frames into the Multimedia CAN (M-Can) of the vehicle.\", \"disclosure_date\": \"2020-12-02\", \"fullname\": \"post/android/local/koffee\", \"is_install_path\": true, \"mod_time\": \"2023-02-03 18:12:53 +0000\", \"name\": \"KOFFEE - Kia OFFensivE Exploit\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"screen-effects\", \"config-changes\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/post/android/local/koffee.rb\", \"platform\": \"Android\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"android/local/koffee\", \"references\": [\"CVE-2020-8539\", \"URL-https://sowhat.iit.cnr.it/pdf/IIT-20-2020.pdf\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": null, \"type\": \"post\"}", "creation_timestamp": "2026-09-08T06:52:40.578536Z"}]}