CVE-2025-32056

4.0 mediumEPSS 0.3%

Medium (4.0). EPSS 0.3% chance of exploitation in the next 30 days.

The anti-theft protection mechanism can be bypassed by attackers due to weak response generation algorithms for the head unit. It is possible to reveal all 32 corresponding responses by sniffing CAN traffic or by pre-calculating the values, which allow to bypass the protection. First identified on Nissan Leaf ZE1 manufactured in 2020.

Severity

CVSS 3.1

4.0 medium

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
CWE: CWE-1241
Published: 2026-01-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf
https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch
https://www.nissan.co.uk/vehicles/new-vehicles/leaf.html

Check your stack JSON