平台
other
组件
redbend-service
修复版本
283.0.1
CVE-2025-32057 describes a security vulnerability in the Bosch Infotainment ECU found in the Nissan Leaf ZE1 (2020). This vulnerability stems from a failure to verify the root certificate during communication with the Redbend backend server, allowing for potential man-in-the-middle attacks. The vulnerability has a CVSS score of 6.5 (MEDIUM) and is addressed by upgrading to firmware version 283.0.1.
An attacker exploiting this vulnerability could potentially impersonate the Redbend backend server, intercepting and manipulating over-the-air (OTA) updates delivered to the vehicle's infotainment system. This could lead to the installation of malicious software, compromising vehicle functionality and potentially enabling unauthorized access to sensitive data. The attacker could inject malicious code into the update process, leading to persistent compromise of the infotainment system. This could include altering navigation data, injecting advertisements, or even gaining control of vehicle functions, depending on the capabilities of the infotainment system.
This vulnerability was first identified in the Nissan Leaf ZE1 manufactured in 2020. There is currently no public proof-of-concept (POC) available, but the potential for exploitation is considered medium due to the relatively straightforward nature of man-in-the-middle attacks. The vulnerability is not currently listed on the CISA KEV catalog. Public disclosure occurred on 2026-01-22.
Nissan Leaf ZE1 vehicles manufactured in 2020 are directly at risk. Vehicles that have undergone aftermarket modifications to the infotainment system, particularly those involving custom firmware or network configurations, may be at increased risk. Shared vehicle fleets or rental car services utilizing the Nissan Leaf ZE1 are also potentially vulnerable.
disclosure
漏洞利用状态
EPSS
0.01% (0% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2025-32057 is to upgrade the vehicle's infotainment ECU firmware to version 283.0.1 or later. Nissan should release an official OTA update to address this issue. Until the update is available, consider isolating the vehicle from untrusted networks to minimize the risk of interception. While a full rollback is not feasible, ensure that any third-party applications or modifications to the infotainment system are thoroughly vetted to prevent the introduction of malicious code. Monitor network traffic for suspicious connections to Redbend servers.
更新 Redbend 服务的 SSL/TLS 配置以启用服务器根证书的验证。这将防止攻击者使用自签名证书冒充 Redbend 后端服务器。请参阅信息娱乐ECU (Infotainment ECU) 制造商的文档，以获取有关如何正确配置 SSL/TLS 证书验证的具体说明。
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2025-32057 is a medium-severity vulnerability affecting the Bosch Infotainment ECU in the Nissan Leaf ZE1 (2020) that allows attackers to impersonate Redbend servers due to a lack of SSL certificate verification.
If you own a Nissan Leaf ZE1 manufactured in 2020, you may be affected. Check for available firmware updates from Nissan to mitigate the risk.
Upgrade the vehicle's infotainment ECU firmware to version 283.0.1 or later. Monitor Nissan's official channels for update availability.
There are currently no confirmed reports of active exploitation, but the potential for exploitation exists due to the vulnerability's nature.
Refer to Nissan's official website or contact your local Nissan dealership for the latest security advisories and firmware updates related to CVE-2025-32057.