« Volver al listado

CVE-2025-32060

Estado: AplazadaMedia (6.7)—

The system suffers from the absence of a kernel module signature verification. If an attacker can execute commands on behalf of root user (due to additional vulnerabilities), then he/she is also able to load custom kernel modules to the kernel space and execute code in the kernel context. Such a flaw can lead to taking control over the entire system.

First identified on Nissan Leaf ZE1 manufactured in 2020.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Nissan — Leaf ZE1AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-32060",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-32060",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-17T20:07:32.768943Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@asrg.io",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@asrg.io",
      "affectedData": [
        {
          "vendor": "Bosch",
          "product": "Infotainment system ECU",
          "versions": [
            {
              "status": "affected",
              "version": "283C30861E"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-15T11:15:54.023",
  "references": [
    {
      "url": "http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf",
      "source": "cve@asrg.io"
    },
    {
      "url": "https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch",
      "source": "cve@asrg.io"
    },
    {
      "url": "https://www.nissan.co.uk/vehicles/new-vehicles/leaf.html",
      "source": "cve@asrg.io"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@asrg.io",
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The system suffers from the absence of a kernel module signature verification. If an attacker can execute commands on behalf of root user (due to additional vulnerabilities), then he/she is also able to load custom kernel modules to the kernel space and execute code in the kernel context. Such a flaw can lead to taking control over the entire system.\n\n\n\nFirst identified on Nissan Leaf ZE1 manufactured in 2020."
    },
    {
      "lang": "es",
      "value": "El sistema adolece de la ausencia de una verificación de firma de módulo del kernel. Si un atacante puede ejecutar comandos en nombre del usuario root (debido a vulnerabilidades adicionales), entonces también puede cargar módulos del kernel personalizados al espacio del kernel y ejecutar código en el contexto del kernel. Dicha falla puede llevar a tomar el control de todo el sistema.\n\nIdentificado por primera vez en un Nissan Leaf ZE1 fabricado en 2020."
    }
  ],
  "lastModified": "2026-06-17T09:11:23.350",
  "sourceIdentifier": "cve@asrg.io"
}