Vulnerability Details : CVE-2023-29389
Toyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows physically proximate attackers to drive a vehicle by accessing the control CAN bus after pulling the bumper away and reaching the headlight connector, and then sending forged "Key is validated" messages via CAN Injection, as exploited in the wild in (for example) July 2022.
Exploit prediction scoring system (EPSS) score for CVE-2023-29389
Probability of exploitation activity in the next 30 days: 0.05%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 19 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2023-29389
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
6.8
|
MEDIUM | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
0.9
|
5.9
|
NIST |
CWE ids for CVE-2023-29389
-
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-29389
-
https://kentindell.github.io/2023/04/03/can-injection/
CAN Injection: keyless car theft | Dr. Ken TindellExploit;Third Party Advisory
-
https://news.ycombinator.com/item?id=35452963
Can Injection: keyless car theft | Hacker NewsIssue Tracking
Products affected by CVE-2023-29389
- cpe:2.3:o:toyota:rav4_firmware:2021:*:*:*:*:*:*:*