1. Home
  2. CVE Database
  3. CVE-2018-18203
MEDIUM · 6.4

CVE-2018-18203

A vulnerability in the update mechanism of Subaru StarLink Harman head units 2017, 2018, and 2019 may give an attacker (with physical access to the vehicle's USB ports) the ability to rewrite the firm...

Vulnerability Description

A vulnerability in the update mechanism of Subaru StarLink Harman head units 2017, 2018, and 2019 may give an attacker (with physical access to the vehicle's USB ports) the ability to rewrite the firmware of the head unit. This occurs because the device accepts modified QNX6 filesystem images (as long as the attacker obtains access to certain Harman decryption/encryption code) as a consequence of a bug where unsigned images pass a validity check. An attacker could potentially install persistent malicious head unit firmware and execute arbitrary code as the root user.

CVSS Score

6.4

MEDIUM

CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
PHYSICAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
SubaruStarlink 2017 Firmware-
SubaruStarlink 2017-
SubaruStarlink 2018 Firmware-
SubaruStarlink 2018-
SubaruStarlink 2019 Firmware-
SubaruStarlink 2019-

Related Weaknesses (CWE)

CWE-347

References

FAQ

What is CVE-2018-18203?

CVE-2018-18203 is a vulnerability with a CVSS score of 6.4 (MEDIUM). A vulnerability in the update mechanism of Subaru StarLink Harman head units 2017, 2018, and 2019 may give an attacker (with physical access to the vehicle's USB ports) the ability to rewrite the firm...

How severe is CVE-2018-18203?

CVE-2018-18203 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-18203?

Check the references section above for vendor advisories and patch information. Affected products include: Subaru Starlink 2017 Firmware, Subaru Starlink 2017, Subaru Starlink 2018 Firmware, Subaru Starlink 2018, Subaru Starlink 2019 Firmware.