CVE-2024-8356

HIGH 7.8CVE-2024-8356 · Published 22/11/2024 · updated 17/06/2026

In short

CVE-2024-8356 is a HIGH (CVSS 7.8) vulnerability affecting infotainment (visteon).
Chance of exploitation in the next 30 days (EPSS): 0.17%, higher than 6.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
infotainment visteon	`= cmu150_na_74.00.324a`	No fix yet

Description

Visteon Infotainment VIP MCU Code Insufficient Validation of Data Authenticity Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment systems. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the firmware update process of the VIP microcontroller. The process does not properly verify authenticity of the supplied firmware image before programming it into internal memory. An attacker can leverage this vulnerability to escalate privileges execute arbitrary code in the context of the VIP MCU. Was ZDI-CAN-23758.

References

zerodayinitiative.com/advisories/ZDI-24-1188 · Third Party Advisory

More vulnerabilities in infotainment

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

infotainment

visteon

= cmu150_na_74.00.324a

No fix yet

Description

More vulnerabilities in infotainment

See all →