CVE-2023-29389 — MEDIUM (6.8)

Vulnerability Description

Toyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows physically proximate attackers to drive a vehicle by accessing the control CAN bus after pulling the bumper away and reaching the headlight connector, and then sending forged "Key is validated" messages via CAN Injection, as exploited in the wild in (for example) July 2022.

CVSS Score

6.8

MEDIUM

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Toyota	Rav4 Firmware	2021
Toyota	Rav4	-

Related Weaknesses (CWE)

CWE-74

References

https://kentindell.github.io/2023/04/03/can-injection/ExploitThird Party Advisory
https://news.ycombinator.com/item?id=35452963Issue Tracking
https://kentindell.github.io/2023/04/03/can-injection/ExploitThird Party Advisory
https://news.ycombinator.com/item?id=35452963Issue Tracking

FAQ

What is CVE-2023-29389?

CVE-2023-29389 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Toyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows physically proximate attackers to drive a vehicle by accessing the control CAN bus after pulling the b...

How severe is CVE-2023-29389?

CVE-2023-29389 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-29389?

Check the references section above for vendor advisories and patch information. Affected products include: Toyota Rav4 Firmware, Toyota Rav4.