CVE-2023-28897

9.8 criticalEPSS 0.3%

Critical (9.8) in skoda-auto superb 3 firmware. EPSS 0.3% chance of exploitation in the next 30 days.

The secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware. Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE: CWE-798
Published: 2024-01-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

skoda-auto:superb_3_firmware

References

https://asrg.io/security-advisories/cve-2023-28897
https://asrg.io/security-advisories/cve-2023-28897

Check your stack JSON