Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Feb 13, 2025An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6.CVE-2024-37603 · Other software · Mercedes-benz · reported by MITREMedium 4.6
An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6. A possible type confusion exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. With prepared data, an attacker can cause the User-Data service to fail. The failed service instance will restart automatically.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021.CVE-2024-37602 · Other software · Mercedes-benz · reported by MITREMedium 4.6
An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021. A possible NULL pointer dereference in the Apple Car Play function affects NTG 6 head units. To perform this attack, physical access to Ethernet pins of the head unit base board is needed. With a static IP address, an attacker can connect via the internal network to the AirTunes / AirPlay service. With prepared HTTP requests, an attacker can cause the Car Play service to fail.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6.CVE-2024-37601 · Other software · Mercedes-benz · reported by MITREMedium 4.6
An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6. A possible heap buffer overflow exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. With prepared data, an attacker can cause the User-Data service to fail. The failed service instance will restart automatically.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021.CVE-2024-37600 · Other software · Mercedes-benz · reported by MITREMedium 6.8
An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021. A possible stack buffer overflow in the Service Broker service affects NTG 6 head units. To perform this attack, physical access to Ethernet pins of the head unit base board is needed. With a static IP address, an attacker can connect via the internal network to the Service Broker service. With prepared HTTP requests, an attacker can cause the Service-Broker service to fail.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025An issue was discovered on Mercedes Benz NTG 6.CVE-2023-34406 · Other software · Mercedes-benz · reported by MITRELow 3.3
An issue was discovered on Mercedes Benz NTG 6. A possible integer overflow exists in the user data import/export function of NTG (New Telematics Generation) 6 head units. To perform this attack, local access to USB interface of the car is needed. With prepared data, an attacker can cause the User-Data service to fail. The failed service instance will restart automatically.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB.CVE-2023-34404 · Other software · Mercedes-benz · reported by MITREMedium 4.9
Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to these pins and get access to internal network. As a result, by accessing a specific port an attacker can send call request to all registered services in router and achieve command injection vulnerability.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB.CVE-2023-34403 · Other software · Mercedes-benz · reported by MITREMedium 4.9
Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to this pins and get access to internal network. A race condition can be acquired and attacker can spoof “UserData” with desirable file path and access it though backup on USB.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.CVE-2023-34402 · Other software · Mercedes-benz · reported by MITREHigh 7.7
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside file is encapsulate another file, which service will drop during processing. Due to missed checks, attacker can achieve Arbitrary File Write with service speech rights.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.CVE-2023-34401 · Other software · Mercedes-benz · reported by MITRELow 3.7
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside profile folder there is a file, which is encoded with proprietary UD2 codec. Due to missed size checks in the enapsulate file, attacker can achieve Out-of-Bound Read in heap memory.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.CVE-2023-34400 · Other software · Mercedes-benz · reported by MITREHigh 7.5
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. In case of parsing file, service try to define header inside the file and convert it to null-terminated string. If character is missed, will return null pointer.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.CVE-2023-34399 · Other software · Mercedes-benz · reported by MITRECritical 9.8
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost library. The version of boost library contains vulnerability integer overflow.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.CVE-2023-34398 · Other software · Mercedes-benz · reported by MITREHigh 7.5
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost library. The boost library contains a vulnerability/null pointer dereference.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025Mercedes Benz head-unit NTG 6 contains functions to import or export profile settings over USB.CVE-2023-34397 · Other software · Mercedes-benz · reported by MITREHigh 7.5
Mercedes Benz head-unit NTG 6 contains functions to import or export profile settings over USB. During parsing you can trigger that the service will be crashed.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2021An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021.CVE-2021-23908 · Other software · Mercedes-benz · reported by MITRELow 2.9
An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A type confusion issue affects MultiSvSetAttributes in the HiQnet Protocol, leading to remote code execution.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkeenlab.tencent.comkeenlab.tencent.com
May 13, 2021An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021.CVE-2021-23907 · Other software · Mercedes-benz · reported by MITRELow 2.9
An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The count in MultiSvGet, GetAttributes, and MultiSvSet is not checked in the HiQnet Protocol, leading to remote code execution.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkeenlab.tencent.comkeenlab.tencent.com
May 13, 2021An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021.CVE-2021-23906 · Other software · Mercedes-benz · reported by MITRELow 1.8
An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A Message Length is not checked in the HiQnet Protocol, leading to remote code execution.
- Product
- Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkeenlab.tencent.comkeenlab.tencent.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.