CVE-2023-26246

7.8 HIGH
Published: April 27, 2023 Modified: April 06, 2026
View on NVD

Description

An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the digital signature check. This indirectly allows an attacker to install custom firmware in the IVI system.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://sowhat.iit.cnr.it
Source: cve@mitre.org
Not Applicable
https://sowhat.iit.cnr.it:8443/can-work/chimaera
Source: cve@mitre.org
Exploit Third Party Advisory
https://sowhat.iit.cnr.it:8443/can-work/chimaera/-/blob/main/Report/IIT-01-2023.pdf
Source: cve@mitre.org
Exploit Third Party Advisory
https://sowhat.iit.cnr.it
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable
https://sowhat.iit.cnr.it:8443/can-work/chimaera
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory
https://sowhat.iit.cnr.it:8443/can-work/chimaera/-/blob/main/Report/IIT-01-2023.pdf
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory

6 reference(s) from NVD

Quick Stats

CVSS v3 Score
7.8 / 10.0
EPSS (Exploit Probability)
0.0%
1th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-269 CWE-863

Affected Vendors

hyundai

Related CVEs

CVE-2026-5832 7.3
CVE-2026-5831 6.3
CVE-2026-5830 8.8
CVE-2026-5829 7.3
CVE-2026-5828 7.3