{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-29T20:53:02.662","vulnerabilities":[{"cve":{"id":"CVE-2025-32058","sourceIdentifier":"cve@asrg.io","published":"2026-02-15T11:15:52.773","lastModified":"2026-06-17T09:11:23.153","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Infotainment ECU manufactured by Bosch uses a RH850 module for CAN communication. RH850 is connected to infotainment over the INC interface through a custom protocol. There is a vulnerability during processing requests of this protocol on the V850 side which allows an attacker with code execution on the infotainment main SoC to perform code execution on the RH850 module and subsequently send arbitrary CAN messages over the connected CAN bus.\n\n\n\nFirst identified on Nissan Leaf ZE1 manufactured in 2020."},{"lang":"es","value":"La ECU de infoentretenimiento fabricada por Bosch utiliza un módulo RH850 para la comunicación CAN. El RH850 está conectado al infoentretenimiento a través de la interfaz INC mediante un protocolo personalizado. Existe una vulnerabilidad durante el procesamiento de solicitudes de este protocolo en el lado V850 que permite a un atacante con ejecución de código en el SoC principal de infoentretenimiento realizar ejecución de código en el módulo RH850 y posteriormente enviar mensajes CAN arbitrarios a través del bus CAN conectado.\n\nIdentificada por primera vez en el Nissan Leaf ZE1 fabricado en 2020."}],"affected":[{"source":"cve@asrg.io","affectedData":[{"vendor":"Bosch","product":"Infotainment system ECU","defaultStatus":"unaffected","platforms":["Linux"],"versions":[{"version":"283C30861E","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@asrg.io","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-17T20:02:29.752256Z","id":"CVE-2025-32058","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@asrg.io","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf","source":"cve@asrg.io"},{"url":"https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch","source":"cve@asrg.io"},{"url":"https://www.nissan.co.uk/vehicles/new-vehicles/leaf.html","source":"cve@asrg.io"}]}}]}