CVE-2024-8358

Summary

CVE-2024-8358 is a remote code execution vulnerability affecting Visteon Infotainment systems. attackers who are physically present can exploit this flaw by crafting a malicious software update file. The UPDATES_ExtractFile function, specifically, is the culprit, as it allows the execution of a system call derived from a user-supplied string. This vulnerability, identified as ZDI-CAN-23422, doesn't require authentication for exploitation, potentially enabling attackers to gain unauthorized access and execute arbitrary code on affected devices.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.