CVE-2024-8358

MEDIUM 6.8CVE-2024-8358 · Published 22/11/2024 · updated 17/06/2026

In short

CVE-2024-8358 is a MEDIUM (CVSS 6.8) vulnerability affecting infotainment (visteon).
Chance of exploitation in the next 30 days (EPSS): 0.88%, higher than 59.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
infotainment visteon	`= cmu150_na_74.00.324a`	No fix yet

Description

Visteon Infotainment UPDATES_ExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPDATES_ExtractFile function. A crafted software update file can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23422.

References

zerodayinitiative.com/advisories/ZDI-24-1190 · Third Party Advisory

More vulnerabilities in infotainment

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

infotainment

visteon

= cmu150_na_74.00.324a

No fix yet

Description

More vulnerabilities in infotainment

See all →