FKIE_CVE-2025-32058

Vulnerability from fkie_nvd - Published: 2026-02-15 11:15 - Updated: 2026-02-18 17:52
Severity ?
9.3 (Critical) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
The Infotainment ECU manufactured by Bosch uses a RH850 module for CAN communication. RH850 is connected to infotainment over the INC interface through a custom protocol. There is a vulnerability during processing requests of this protocol on the V850 side which allows an attacker with code execution on the infotainment main SoC to perform code execution on the RH850 module and subsequently send arbitrary CAN messages over the connected CAN bus. First identified on Nissan Leaf ZE1 manufactured in 2020.
References
cve@asrg.iohttp://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf
cve@asrg.iohttps://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch
cve@asrg.iohttps://www.nissan.co.uk/vehicles/new-vehicles/leaf.html
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Infotainment ECU manufactured by Bosch uses a RH850 module for CAN communication. RH850 is connected to infotainment over the INC interface through a custom protocol. There is a vulnerability during processing requests of this protocol on the V850 side which allows an attacker with code execution on the infotainment main SoC to perform code execution on the RH850 module and subsequently send arbitrary CAN messages over the connected CAN bus.\n\n\n\nFirst identified on Nissan Leaf ZE1 manufactured in 2020."
    },
    {
      "lang": "es",
      "value": "La ECU de infoentretenimiento fabricada por Bosch utiliza un m\u00f3dulo RH850 para la comunicaci\u00f3n CAN. El RH850 est\u00e1 conectado al infoentretenimiento a trav\u00e9s de la interfaz INC mediante un protocolo personalizado. Existe una vulnerabilidad durante el procesamiento de solicitudes de este protocolo en el lado V850 que permite a un atacante con ejecuci\u00f3n de c\u00f3digo en el SoC principal de infoentretenimiento realizar ejecuci\u00f3n de c\u00f3digo en el m\u00f3dulo RH850 y posteriormente enviar mensajes CAN arbitrarios a trav\u00e9s del bus CAN conectado.\n\nIdentificada por primera vez en el Nissan Leaf ZE1 fabricado en 2020."
    }
  ],
  "id": "CVE-2025-32058",
  "lastModified": "2026-02-18T17:52:22.253",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 6.0,
        "source": "cve@asrg.io",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-15T11:15:52.773",
  "references": [
    {
      "source": "cve@asrg.io",
      "url": "http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf"
    },
    {
      "source": "cve@asrg.io",
      "url": "https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch"
    },
    {
      "source": "cve@asrg.io",
      "url": "https://www.nissan.co.uk/vehicles/new-vehicles/leaf.html"
    }
  ],
  "sourceIdentifier": "cve@asrg.io",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ],
      "source": "cve@asrg.io",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.