{"id":"CVE-2023-28895","aliases":["EUVD-2023-32515","GHSA-f52g-mqvx-jmjp"],"status":"published","title":"Hard-coded password for access to power controller chip memory","description":"The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip.\n\nVulnerability found on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00313,"percentile":0.24352,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-259","CWE-798"],"published":"2023-12-01T13:41:16Z","modified":"2026-06-17T05:48:59Z","products":[{"vendor":"joynext","product":"mib3 infotainment unit"},{"vendor":"preh","product":"mib3_firmware"}],"references":[{"url":"https://asrg.io/security-advisories/hard-coded-password-for-access-to-power-controller-chip-memory/","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28895"},{"url":"https://github.com/advisories/GHSA-f52g-mqvx-jmjp"}],"sources":{"cve":[{"id":"CVE-2023-28895","title":"Hard-coded password for access to power controller chip memory","description":"The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip.\n\nVulnerability found on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.","status":"published","published":"2023-12-01T13:41:16.581Z","modified":"2024-12-02T17:48:05.077Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-259"],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-32515","description":"The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip.\n\nVulnerability found on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.","status":"published","published":"2023-12-01T13:41:16Z","modified":"2024-12-02T17:48:05Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-03T00:04:43.613884Z"}],"ghsa":[{"id":"GHSA-f52g-mqvx-jmjp","title":"The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3...","description":"The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip.\n\nVulnerability found on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.","status":"published","published":"2023-12-01T15:31:21Z","modified":"2023-12-15T05:05:40Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-259","CWE-798"],"updated_at":"2026-11-02T14:55:12.439342Z"}],"nvd":[{"id":"CVE-2023-28895","description":"The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip.\n\nVulnerability found on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.","status":"published","published":"2023-12-01T14:15:07.54Z","modified":"2026-06-17T05:48:59.553Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-259","CWE-798"],"updated_at":"2026-11-02T14:08:52.544469Z"}]}}