CVE-2025-32058 - Vulnerability Analysis

Overview

Bosch Infotainment ECU with RH850 module contains a remote code execution vulnerability caused by improper processing of custom INC protocol requests, letting attackers with code execution on infotainment SoC execute code on RH850 and send arbitrary CAN messages.

Severity & Score

Impact

Attackers with code execution on infotainment SoC can execute code on RH850 and send arbitrary CAN messages, potentially compromising vehicle control systems.

Mitigation

Update to the latest version with fixed INC protocol processing.

References

• https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch
• https://www.nissan.co.uk/vehicles/new-vehicles/leaf.html
• http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner