CVE-2024-51073
An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to control or disrupt CAN communication between the instrument cluster and CAN bus.
Does this matter?
Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own.
Description
An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to control or disrupt CAN communication between the instrument cluster and CAN bus. NOTE: this is disputed by the Supplier because the findings came from a potentially unrealistic test environment (an isolated ECU part that was not in a vehicle), and because the observed behavior follows the UDS (Unified Diagnostic Services) specification.
- CVSS 3.1
- 6.7 MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
- EPSS
- 0.32% probability · 25th percentile
- CISA KEV
- Not listed
- Source
- cve@mitre.org
References
- https://github.com/nitinronge91/KIA-SELTOS-Cluster-Vulnerabilities/blob/3755e3f692dce5b1ab06de2d04a2433c907ab21c/CVE/Control%20CAN%20communication%20for%20KIA%20SELTOS%20Cluster%20CVE-2024-51073.md
- https://udsoncan.readthedocs.io/en/latest/udsoncan/services.html
- https://www.iso.org/standard/77323.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.