CVE-2023-28895: Preh MIB3 Firmware

Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days.

The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.

Affected products

• Preh MIB3 Firmware: before 0304 (fixed in 0304)

Published 2023-12-01. Last modified 2026-06-17.