CVE-2018-9311
The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW...
The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW vehicles produced in 2012 through 2018, allows a remote attack via a cellular network.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW vehicles produced in 2012 through 2018, allows a remote attack via a cellular network.
- Record
CVE-2018-9311- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-693
- Updated
- 2026-11-02
CVE List No score
The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW vehicles produced in 2012 through 2018, allows a remote attack via a cellular network.
- Record
CVE-2018-9311- Updated
- 2026-11-02
EUVDEUVD-2018-20905 No score
The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW vehicles produced in 2012 through 2018, allows a remote attack via a cellular network.
- Record
EUVD-2018-20905- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2qr9-8w8c-wvq4
The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW...
The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW vehicles produced in 2012 through 2018, allows a remote attack via a cellular network.
- Record
GHSA-2qr9-8w8c-wvq4- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-693
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-9311 is a critical vulnerability (CVSS 9.8) in Bmw Telematics Control Unit Firmware, published May 31, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.86%, the 90th percentile. No source names a fixed version.