{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-27T16:39:28.560","vulnerabilities":[{"cve":{"id":"CVE-2024-8355","sourceIdentifier":"zdi-disclosures@trendmicro.com","published":"2024-11-22T22:15:18.860","lastModified":"2024-12-19T18:47:39.363","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Visteon Infotainment System DeviceManager iAP Serial Number SQL Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment system. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the DeviceManager. When parsing the iAP Serial number, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20112."},{"lang":"es","value":"Vulnerabilidad de inyección SQL del número de serie de iAP en el DeviceManager del sistema de información y entretenimiento Visteon. Esta vulnerabilidad permite a atacantes físicamente presentes ejecutar código arbitrario en las instalaciones afectadas del sistema de información y entretenimiento Visteon. No se requiere autenticación para explotar esta vulnerabilidad. La falla específica existe dentro del DeviceManager. Al analizar el número de serie de iAP, el proceso no valida correctamente una cadena proporcionada por el usuario antes de usarla para construir consultas SQL. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto de la raíz. Era ZDI-CAN-20112."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"cvssMetricV30":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}]},"weaknesses":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:visteon:infotainment_firmware:74.00.311a:*:*:*:*:*:*:*","matchCriteriaId":"7AF67CD8-87ED-482D-85DC-118067DF268B"}]}]}],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1208/","source":"zdi-disclosures@trendmicro.com","tags":["Vendor Advisory"]}]}}]}