Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
A use-after-free flaw in the Microsoft Windows Bluetooth Service lets an unauthorized attacker execute code over an adjacent network, affecting numerous Windows 10, Windows 11, and Windows Server versions. This could be relevant where Windows-based systems are deployed in automotive environments, such as in-vehicle infotainment, telematics, or diagnostic platforms that use Bluetooth. Confirm applicability through the product SBOM or dependency inventory.
A use-after-free flaw in the Windows Bluetooth Port Driver lets an unauthorized attacker on an adjacent network elevate privileges. The affected products are listed Microsoft Windows 10, Windows 11 and Windows Server versions. This could be relevant where Windows-based systems are deployed in automotive environments, such as in-vehicle infotainment, telematics or diagnostic platforms. Confirm applicability through the product SBOM or dependency inventory.
Red Hat has released an Important-rated security update for the opentelemetry-collector component on Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, fixing a flaw in the gRPC-Go library where a remote client can send a malformed RPC request missing required headers and crash the entire server process, causing a denial of service that in some deployments can be unauthenticated. This could be relevant where the OpenTelemetry Collector or gRPC-Go is deployed in automotive systems, such as telemetry or monitoring infrastructure, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the tftp-hpa TFTP server daemon (in.tftpd) can cause an out-of-bounds read/write when it processes a specially crafted request under a non-default filename remapping configuration, allowing a remote, unauthenticated attacker to crash the daemon and cause a denial of service. Red Hat rates this update as Moderate severity. TFTP is commonly used for network booting of diskless workstations, so this could be relevant where tftp-hpa is deployed in automotive or embedded environments that rely on network boot or file transfer; confirm applicability through the product SBOM or dependency inventory.
Siemens reports multiple vulnerabilities in Nozomi Guardian/CMC software running on RUGGEDCOM APE1808 devices, an industrial product. An authenticated attacker could execute malicious code in a victim's browser, view or tamper with credential entries, intercept and replay credentials via man-in-the-middle attacks, bypass access controls to alter monitoring configuration, or compromise audit-trail integrity through cross-site request forgery. Siemens rates these as serious enough to recommend contacting customer support for patch and update information.
The .NET Client Library for SIMATIC S7 Webserver API has two vulnerabilities: one lets an attacker who can manipulate ticket responses write arbitrary files outside the intended download directory, and the other exposes PLC restore passwords in plaintext through HTTP error messages, potentially allowing unauthorized PLC operations. Siemens has released a new version and recommends updating to the latest version. This is an automotive-relevant industrial control component because it directly interacts with SIMATIC S7 PLCs used in automotive manufacturing and production systems.
Zephyr's Bluetooth LE host contains a use-after-free flaw in its L2CAP connection-oriented channel handling, where a pending receive work item is not cancelled when a channel is torn down. A remote, unauthenticated attacker with an established channel could send a data frame followed by a disconnect request, causing the system to access freed or reused memory, potentially leading to memory corruption or dropped work items. This could be relevant where Zephyr is deployed in automotive systems, such as Bluetooth-enabled ECUs or telematics units. Confirm applicability through the product SBOM or dependency inventory.
OpENer v2.3 (commit 76b95cf) contains an out-of-bounds read in its server-side EtherNet/IP ForwardOpen connection-path parser, which a remote attacker can exploit to cause a denial of service. The advisory does not state a severity rating. This could be relevant where OpENer is deployed in automotive or industrial systems using EtherNet/IP. Confirm applicability through the product SBOM or dependency inventory.
EIPStackGroup OpENer version 2.3 and master commit 76b95cf contain a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service, which a remote attacker can exploit to cause a denial of service. This could be relevant where OpENer is deployed in automotive systems, since EtherNet/IP is an industrial protocol used in embedded and control environments. Confirm applicability through the product SBOM or dependency inventory.
EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contains an out-of-bounds read in its EtherNet/IP TCP SendRRData Common Packet Format parser, specifically in CreateCommonPacketFormatStructure(), which fails to validate that the remaining buffer holds a complete fixed sockaddr structure before parsing optional socket address items of type 0x8000 or 0x8001. A remote attacker can exploit this to cause a denial of service. The advisory does not state a severity rating. This could be relevant where OpENer is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
The advisory describes a vulnerability in EIPStackGroup OpENer versions 2.3 and master up to commit 76b95cf, where an expired pointer dereference in the EtherNet/IP Common Packet Format handling logic allows a remote attacker to cause a denial of service. The advisory does not state a severity rating. This could be relevant where OpENer is deployed in automotive systems, since EtherNet/IP is an industrial protocol sometimes used in automotive manufacturing environments. Confirm applicability through the product SBOM or dependency inventory.
wolfSSL versions 5.9.1 and 5.9.2 contain a flaw in the ConfirmNameConstraints() function that lets attackers cause a denial of service by supplying crafted Certificate Authority certificates, which can make TLS clients incorrectly reject valid certificates that lack a SAN. This could be relevant where wolfSSL is deployed in automotive systems, since affected TLS clients may become unable to establish connections. Confirm applicability through the product SBOM or dependency inventory.
A heap buffer overflow exists in the Cyrus SASL DIGEST-MD5 plugin, where a buffer size is calculated before quoting is applied and not recalculated, allowing a malicious or on-path DIGEST-MD5 or HTTP Digest server to crash a connecting client by sending a crafted challenge field. The advisory lists affected Red Hat products including Enterprise Linux 6 through 10, Hardened Images, and OpenShift Container Platform 4. This could be relevant where Cyrus SASL is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
Cisco has released a software hardening update addressing multiple internally discovered vulnerabilities, tracked as CVE-2026-76467, related to improper control of a resource through its lifetime (CWE-664). The affected products are Cisco Campus Gateway Software, Cisco Meraki MR Wireless Access Points Software, Cisco Meraki MV Firmware, and Cisco Meraki MX Firmware. The advisory does not state the severity or the specific impact an attacker could achieve, so those details cannot be confirmed from this text. This could be relevant where Cisco Meraki networking components are deployed in automotive systems, for example in vehicle connectivity, fleet, or telematics environments. Confirm applicability through the product SBOM or dependency inventory.
Qualcomm Snapdragon chipsets contain a buffer over-read in the WLAN HAL that can cause a transient denial of service when processing a continuous receive command with a zero-sized global configuration override. An attacker able to trigger this condition could temporarily disrupt WLAN functionality, though the advisory describes the impact as transient. This could be relevant where Qualcomm Snapdragon platforms are deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
AMD Zynq UltraScale+ MPSoC and RFSoC devices have insufficient boundary validation in USB boot mode, allowing unbounded Device Firmware Upgrade requests to overflow the DDR receive buffer into FSBL memory and potentially execute unauthorized code during boot, affecting confidentiality, integrity, or availability. This could be relevant where these devices are deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
AMD Zynq UltraScale+ MPSoC, RFSoC, and Kria SOM devices have insufficient boundary validation in the USB boot mode implementation, which could let an attacker send oversized Device Firmware Upgrade requests that overflow the DDR receive buffer into FSBL memory and potentially achieve unauthorized code execution during boot. This could impact the confidentiality, integrity, or availability of affected systems. This could be relevant where these devices are deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
MediaTek reports a missing bounds check in its Modem component that could allow an attacker controlling a rogue base station to remotely escalate privileges on a connected user device, with user interaction required and no additional execution privileges needed. This could be relevant where MediaTek modem chipsets are deployed in automotive systems, such as in telematics or connectivity modules. Confirm applicability through the product SBOM or dependency inventory.
MediaTek reports a missing bounds check in a modem component that could allow an out of bounds write, enabling remote escalation of privilege when a user equipment connects to a rogue base station controlled by the attacker, with no additional execution privileges or user interaction required. This could be relevant where MediaTek modem chipsets are deployed in automotive systems, such as telematics or connectivity modules. Confirm applicability through the product SBOM or dependency inventory.
A missing bounds check in the MediaTek modem component could allow an attacker controlling a rogue base station to achieve remote escalation of privilege on a connected user equipment, with no user interaction required. MediaTek rates this as a high-severity issue and has released patch MOLY01778993 (Issue ID MSV-8898). This could be relevant where MediaTek modem chipsets are deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
An out-of-bounds access issue exists in OpenSSL related to SSL_set_SSL_CTX() being called during a handshake, which could allow an attacker to trigger the flaw and potentially cause a crash or other memory-related failure. The advisory does not state a severity rating or confirm any automotive deployment. This could be relevant where OpenSSL is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.
Microsoft has disclosed a vulnerability in the QUIC implementation of OpenSSL involving an unbounded RETIRE_CONNECTION_ID backlog, which could allow an attacker to consume excessive memory or resources. The advisory does not state a severity rating or confirm any automotive deployment. This could be relevant where OpenSSL's QUIC functionality is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.
Microsoft has published an advisory for a denial-of-service issue in QUIC STREAM fragment metadata handling, which is associated with OpenSSL. An attacker could exploit this to cause a denial of service, though the advisory excerpt provided does not state a specific severity rating. This could be relevant where OpenSSL or QUIC components are deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The Bransys ELD is affected by vulnerabilities including hardcoded MQTT and FTP credentials and cleartext transmission of sensitive information, which could allow an attacker to gain unauthorized read access to real-time telemetry data and firmware across affected devices. The advisory classifies this under the Transportation Systems sector, indicating a direct automotive/road-transport connection. CISA has not reported any known public exploitation of these vulnerabilities at this time. Confirm applicability through the product SBOM or dependency inventory.
Wire is a data-format library used to encode and decode protocol buffer messages, and versions before 6.4.5 and 7.0.0-alpha04 fail to properly validate attacker-supplied length values, allowing malformed input to cause crashes or excessive memory use. An attacker who can send crafted protobuf data could trigger a denial of service, though the advisory states there is no known impact on confidentiality, integrity, or code execution. This could be relevant where Wire is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.