CVE-2023-28901

5.3 mediumEPSS 0.5%

Medium (5.3) in skoda-auto skoda connect. EPSS 0.5% chance of exploitation in the next 30 days.

The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mileage, fuel consumption, average and maximum speed, and other information of Skoda Connect service users by specifying an arbitrary vehicle VIN number.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2024-01-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

skoda-auto:skoda_connect

References

https://asrg.io/security-advisories/cve-2023-28901/
https://asrg.io/security-advisories/cve-2023-28901/

Check your stack JSON