CVE-2025-32061

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-32061", "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "state": "PUBLISHED", "assignerShortName": "ASRG", "dateReserved": "2025-04-03T15:32:43.282Z", "datePublished": "2026-02-15T10:47:15.555Z", "dateUpdated": "2026-02-17T20:08:17.291Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Infotainment system ECU", "vendor": "Bosch", "versions": [{"status": "affected", "version": "283C30861E"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Mikhail Evdokimov (PCA Cyber Security Assessment Team)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue results from the lack of proper boundary validation of user-supplied data, which can result in a stack-based buffer overflow when receiving a specific packet on the established upper layer L2CAP channel. An attacker can leverage this vulnerability to obtain remote code execution on the Infotainment ECU with root privileges.<br><br>\n\nFirst identified on <span style=\"background-color: var(--wht);\">Nissan Leaf ZE1 manufactured in 2020.</span>\n\n<br>"}], "value": "The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue results from the lack of proper boundary validation of user-supplied data, which can result in a stack-based buffer overflow when receiving a specific packet on the established upper layer L2CAP channel. An attacker can leverage this vulnerability to obtain remote code execution on the Infotainment ECU with root privileges.\n\n\n\nFirst identified on Nissan Leaf ZE1 manufactured in 2020."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "shortName": "ASRG", "dateUpdated": "2026-02-15T10:47:15.555Z"}, "references": [{"tags": ["product"], "url": "https://www.nissan.co.uk/vehicles/new-vehicles/leaf.html"}, {"tags": ["media-coverage"], "url": "http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf"}, {"tags": ["third-party-advisory"], "url": "https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch"}], "source": {"discovery": "UNKNOWN"}, "title": "Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T20:07:52.971119Z", "id": "CVE-2025-32061", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T20:08:17.291Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-32061", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-17T20:07:52.971119Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T20:08:08.130Z"}}], "cna": {"title": "Stack Buffer Overflow leading to RCE in Bluetooth stack of Infotainment ECU", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Mikhail Evdokimov (PCA Cyber Security Assessment Team)"}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Bosch", "product": "Infotainment system ECU", "versions": [{"status": "affected", "version": "283C30861E"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.nissan.co.uk/vehicles/new-vehicles/leaf.html", "tags": ["product"]}, {"url": "http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf", "tags": ["media-coverage"]}, {"url": "https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue results from the lack of proper boundary validation of user-supplied data, which can result in a stack-based buffer overflow when receiving a specific packet on the established upper layer L2CAP channel. An attacker can leverage this vulnerability to obtain remote code execution on the Infotainment ECU with root privileges.\n\n\n\nFirst identified on Nissan Leaf ZE1 manufactured in 2020.", "supportingMedia": [{"type": "text/html", "value": "The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue results from the lack of proper boundary validation of user-supplied data, which can result in a stack-based buffer overflow when receiving a specific packet on the established upper layer L2CAP channel. An attacker can leverage this vulnerability to obtain remote code execution on the Infotainment ECU with root privileges.<br><br>\n\nFirst identified on <span style=\"background-color: var(--wht);\">Nissan Leaf ZE1 manufactured in 2020.</span>\n\n<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "shortName": "ASRG", "dateUpdated": "2026-02-15T10:47:15.555Z"}}}, "cveMetadata": {"cveId": "CVE-2025-32061", "state": "PUBLISHED", "dateUpdated": "2026-02-17T20:08:17.291Z", "dateReserved": "2025-04-03T15:32:43.282Z", "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "datePublished": "2026-02-15T10:47:15.555Z", "assignerShortName": "ASRG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Infotainment system ECU", "vendor": "Bosch", "versions": [{"status": "affected", "version": "283C30861E"}]}], "source": "cve@asrg.io"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue results from the lack of proper boundary validation of user-supplied data, which can result in a stack-based buffer overflow when receiving a specific packet on the established upper layer L2CAP channel. An attacker can leverage this vulnerability to obtain remote code execution on the Infotainment ECU with root privileges.\n\n\n\nFirst identified on Nissan Leaf ZE1 manufactured in 2020."}, {"lang": "es", "value": "La falla espec\u00edfica existe dentro de la pila Bluetooth desarrollada por Alps Alpine de la ECU de infoentretenimiento fabricada por Bosch. El problema se debe a la falta de validaci\u00f3n adecuada de l\u00edmites de los datos proporcionados por el usuario, lo que puede resultar en un desbordamiento de b\u00fafer basado en pila al recibir un paquete espec\u00edfico en el canal L2CAP de capa superior establecido. Un atacante puede aprovechar esta vulnerabilidad para obtener ejecuci\u00f3n remota de c\u00f3digo en la ECU de infoentretenimiento con privilegios de root.\n\nIdentificado por primera vez en Nissan Leaf ZE1 fabricado en 2020."}], "id": "CVE-2025-32061", "lastModified": "2026-06-17T09:11:23.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "cve@asrg.io", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-32061", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T20:07:52.971119Z", "version": "2.0.3"}}]}, "published": "2026-02-15T11:15:54.170", "references": [{"source": "cve@asrg.io", "url": "http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf"}, {"source": "cve@asrg.io", "url": "https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch"}, {"source": "cve@asrg.io", "url": "https://www.nissan.co.uk/vehicles/new-vehicles/leaf.html"}], "sourceIdentifier": "cve@asrg.io", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "cve@asrg.io", "type": "Secondary"}]}

{}

{"created": "2026-02-16T09:43:12.105053+00:00", "updated": "2026-02-16T09:43:12.105119+00:00", "vendors": ["bosch", "bosch$PRODUCT$infotainment_system_ecu"]}