CVE-2020-8539

EPSS 2.3%

Vexday Risk Score

18Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 2.3%KEV nãoPoC —Nuclei —Metasploit simPatch —

Lifecycle

01 Dec 2020Published on NVD

02 Dec 2020Metasploit module available

Weaponization speed

same dayto Metasploit module

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Plan a near-term fix — a public PoC already exists.

Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker to inject commands to generate CAN frames that are sent into the M-CAN bus (Multimedia CAN bus) of the vehicle.

Affected products

n/a · n/a

References

https://gist.github.com/gianpyc/4dc8b0d0c29774a10a97785711e325c3 https://sowhat.iit.cnr.it/pdf/IIT-20-2020.pdf