CVE-2025-32063

Description

There is a misconfiguration vulnerability inside the Infotainment ECU manufactured by BOSCH. The vulnerability happens during the startup phase of a specific systemd service, and as a result, the following developer features will be activated: the disabled firewall and the launched SSH server. First identified on Nissan Leaf ZE1 manufactured in 2020.

PUBLISHED Reserved 2025-04-03 | Published 2026-02-15 | Updated 2026-02-17 | Assigner ASRG

Problem types

CWE-306 Missing Authentication for Critical Function

Product status

Credits

Radu Motspan (PCA Cyber Security Assessment Team) finder

References

www.nissan.co.uk/vehicles/new-vehicles/leaf.html product

i.blackhat.com/...mov-Remote-Exploitation-of-Nissan-Leaf.pdf media-coverage

pcacybersecurity.com/...n-infotainment-manufactured-by-bosch third-party-advisory

cve.org (CVE-2025-32063)

nvd.nist.gov (CVE-2025-32063)

Download JSON