« Volver al listado

CVE-2025-32061

Estado: AplazadaAlta (8.8)—

The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue results from the lack of proper boundary validation of user-supplied data, which can result in a stack-based buffer overflow when receiving a specific packet on the established upper layer L2CAP channel. An attacker can leverage this vulnerability to obtain remote code execution on the Infotainment ECU with root privileges.

First identified on Nissan Leaf ZE1 manufactured in 2020.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:A (red adyacente) sin privilegios previos → T1210. Buffer overflow en L2CAP permite RCE con root: T1059 (ejecución de código) como impacto principal; T1068 como secundario por escalada implícita a root en ECU.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramPrivileged Account ManagementExecution PreventionDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Alpsalpine — Bluetooth StackAIBosch — Infotainment ECUAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-32061",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-32061",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-17T20:07:52.971119Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@asrg.io",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@asrg.io",
      "affectedData": [
        {
          "vendor": "Bosch",
          "product": "Infotainment system ECU",
          "versions": [
            {
              "status": "affected",
              "version": "283C30861E"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-15T11:15:54.170",
  "references": [
    {
      "url": "http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf",
      "source": "cve@asrg.io"
    },
    {
      "url": "https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch",
      "source": "cve@asrg.io"
    },
    {
      "url": "https://www.nissan.co.uk/vehicles/new-vehicles/leaf.html",
      "source": "cve@asrg.io"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@asrg.io",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue results from the lack of proper boundary validation of user-supplied data, which can result in a stack-based buffer overflow when receiving a specific packet on the established upper layer L2CAP channel. An attacker can leverage this vulnerability to obtain remote code execution on the Infotainment ECU with root privileges.\n\n\n\nFirst identified on Nissan Leaf ZE1 manufactured in 2020."
    },
    {
      "lang": "es",
      "value": "La falla específica existe dentro de la pila Bluetooth desarrollada por Alps Alpine de la ECU de infoentretenimiento fabricada por Bosch. El problema se debe a la falta de validación adecuada de límites de los datos proporcionados por el usuario, lo que puede resultar en un desbordamiento de búfer basado en pila al recibir un paquete específico en el canal L2CAP de capa superior establecido. Un atacante puede aprovechar esta vulnerabilidad para obtener ejecución remota de código en la ECU de infoentretenimiento con privilegios de root.\n\nIdentificado por primera vez en Nissan Leaf ZE1 fabricado en 2020."
    }
  ],
  "lastModified": "2026-06-17T09:11:23.450",
  "sourceIdentifier": "cve@asrg.io"
}