Samsung Harman Infotainment vulnerabilities

3 CVEs affecting Samsung Harman Infotainment, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-40293, published 2023-08-14.

More from Samsung.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-40293, published 2023-08-14. Medium severity, CVSS 6.8. EPSS: 1.8% chance of exploitation in the next 30 days. Harman Infotainment 20190525031613 and later allows command injection via unauthenticated RPC with a D-Bus connection object.
• CVE-2023-40292, published 2023-08-14. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. Harman Infotainment 20190525031613 and later discloses the IP address via CarPlay CTRL packets.
• CVE-2023-40291, published 2023-08-14. Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days. Harman Infotainment 20190525031613 allows root access via SSH over a USB-to-Ethernet dongle with a password that is an internal project name.