汽車零日漏洞
漏洞資料庫零日漏洞的嚴重性
超越已知威脅
零日漏洞目前尚無廠商修補方案，但其可利用性已獲得證實。這對組織和企業意味著什麼？
可能造成嚴重損害
已確認的零時差漏洞使惡意行為者能夠利用它們執行可能造成可怕後果的攻擊。
缺乏防禦
在沒有解決方案的情況下，攻擊者有充足的時間反復利用零日漏洞。
影響範圍深廣
鑑於不少 ECU 是使用相同的開源軟體和模組，零日漏洞可能會影響眾多元件。
利用零日漏洞駭入Tesla的現場實際操作
Pwn2Own 2022 溫哥華
掌握現實世界可被利用的漏洞情報
最新汽車零日漏洞資料庫
以下是研究人員透過趨勢科技零日計畫 (ZDI) 發現的尚未公開揭露的汽車漏洞清單。由 VicOne 和 趨勢ZDI 共同主辦的 Pwn2Own Automotive漏洞揭露競賽中所發現的零日漏洞亦包含在這份初始清單中。對於每個漏洞，受影響的供應商已聯繫上，並且他們也預計將開始修補。當供應商們致力於針對這些漏洞進行修補，VicOne 客戶的漏洞在公開揭露之前，會先被部署虛擬補丁或更新規則來保護其免於遭到威脅或是利用。這些漏洞皆依據 趨勢ZDI 揭露政策進行處理。
| Zero-day identifier | CVE | Category | Impact |
|---|---|---|---|
| ZDI-CAN-26337 | Not yet assigned | Electric Vehicle Chargers | Compromise the integrity of downloaded information. |
| ZDI-CAN-26307 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-26283 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of service account. |
| ZDI-CAN-26316 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-26322 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-26312 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-26357 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of the device. |
| ZDI-CAN-26331 | Not yet assigned | Electric Vehicle Chargers | Bypass authentication on the system. |
| ZDI-CAN-26350 | Not yet assigned | Electric Vehicle Chargers | Execute code in the context of the device. |
| ZDI-CAN-26324 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-26290 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of service account. |
| ZDI-CAN-26286 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of service account. |
| ZDI-CAN-26285 | Not yet assigned | In-Vehicle Infotainment (IVI) | Bypass authentication on the system. |
| ZDI-CAN-26284 | Not yet assigned | In-Vehicle Infotainment (IVI) | Bypass authentication on the system. |
| ZDI-CAN-26318 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-26311 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-26300 | Not yet assigned | Electric Vehicle Chargers | Execute code in the context of the device. |
| ZDI-CAN-26327 | Not yet assigned | Electric Vehicle Chargers | Execute code in the context of the device. |
| ZDI-CAN-26297 | Not yet assigned | Operating System | Execute code in the context of root. |
| ZDI-CAN-26348 | Not yet assigned | Operating System | Disclose sensitive information. |
| ZDI-CAN-26305 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-26330 | Not yet assigned | Electric Vehicle Chargers | Execute code in the context of the device. |
| ZDI-CAN-26332 | Not yet assigned | Electric Vehicle Chargers | Firewall Bypass. |
| ZDI-CAN-26295 | Not yet assigned | Electric Vehicle Chargers | Bypass authentication on the system. |
| ZDI-CAN-26339 | Not yet assigned | Electric Vehicle Chargers | Execute code in the context of root. |
| ZDI-CAN-26340 | Not yet assigned | Electric Vehicle Chargers | Disclose sensitive information. |
| ZDI-CAN-26334 | Not yet assigned | Electric Vehicle Chargers | Execute code in the context of service account. |
| ZDI-CAN-26333 | Not yet assigned | Electric Vehicle Chargers | Compromise the integrity of downloaded information. |
| ZDI-CAN-26292 | Not yet assigned | Electric Vehicle Chargers | Bypass authentication on the system. |
| ZDI-CAN-26325 | Not yet assigned | Electric Vehicle Chargers | Escalate privileges and execute arbitrary code in the context of root. |
| ZDI-CAN-26317 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-26306 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-26346 | Not yet assigned | Electric Vehicle Chargers | Bypass authentication on the system. |
| ZDI-CAN-26349 | Not yet assigned | Electric Vehicle Chargers | Execute code in the context of the device. |
| ZDI-CAN-26351 | Not yet assigned | Electric Vehicle Chargers | Disclose sensitive information. |
| ZDI-CAN-26352 | Not yet assigned | Electric Vehicle Chargers | Disclose sensitive information. |
| ZDI-CAN-26353 | Not yet assigned | Electric Vehicle Chargers | Bypass authentication on the system. |
| ZDI-CAN-26354 | Not yet assigned | Electric Vehicle Chargers | Compromise the integrity of downloaded information. |
| ZDI-CAN-26359 | Not yet assigned | Electric Vehicle Chargers | Bypass authentication on the system. |
| ZDI-CAN-26314 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-26299 | Not yet assigned | Electric Vehicle Chargers | Compromise the integrity of downloaded information. |
| ZDI-CAN-26288 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-26328 | Not yet assigned | Electric Vehicle Chargers | Execute code in the context of the device. |
| ZDI-CAN-26355 | Not yet assigned | In-Vehicle Infotainment (IVI) | Compromise the integrity of downloaded information. |
| ZDI-CAN-26294 | Not yet assigned | Electric Vehicle Chargers | Execute code in the context of the device. |
| ZDI-CAN-26315 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-26313 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-26321 | Not yet assigned | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-26338 | Not yet assigned | Electric Vehicle Chargers | Execute code in the context of root. |
| ZDI-CAN-23150 | CVE-2024-23920 | Electric Vehicle Chargers | Execute code in the context of root. |
| ZDI-CAN-23300 | CVE-2024-23921 | Electric Vehicle Chargers | Execute code in the context of root. |
| ZDI-CAN-23187 | CVE-2024-29207 | Electric Vehicle Chargers | Disclose sensitive information. |
| ZDI-CAN-23186 | CVE-2024-29208 | Electric Vehicle Chargers | Execute code in the context of root. |
| ZDI-CAN-22939 | CVE-2024-23922 | In-Vehicle Infotainment (IVI) | Execute code in the context of the device. |
| ZDI-CAN-23184 | CVE-2024-23938 | Electric Vehicle Chargers | Execute code in the context of the device. |
| ZDI-CAN-23189 | CVE-2024-23937 | Electric Vehicle Chargers | Disclose sensitive information. |
| ZDI-CAN-22945 | CVE-2024-23923 | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-23238 | CVE-2024-23933 | In-Vehicle Infotainment (IVI) | Execute code in the context of the device. |
| ZDI-CAN-23244 | CVE-2024-26003 | Electric Vehicle Chargers | Disclose sensitive information. |
| ZDI-CAN-23303 | CVE-2024-26005 | Electric Vehicle Chargers | Execute code in the context of service account. |
| ZDI-CAN-23157 | CVE-2024-7537 | Operating System | Execute code in the context of root. |
| ZDI-CAN-22994 | CVE-2024-23934 | In-Vehicle Infotainment (IVI) | Execute code in the context of the device. |
| ZDI-CAN-23196 | CVE-2024-23958 | Electric Vehicle Chargers | Bypass authentication on the system. |
| ZDI-CAN-23194 | CVE-2024-23959 | Electric Vehicle Chargers | Execute code in the context of the device. |
| ZDI-CAN-23105 | CVE-2024-23924 | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-23101 | CVE-2024-23928 | In-Vehicle Infotainment (IVI) | Compromise the integrity of downloaded information. |
| ZDI-CAN-23301 | CVE-2024-23929 | In-Vehicle Infotainment (IVI) | Create arbitrary files on affected installations. |
| ZDI-CAN-23302 | CVE-2024-23930 | In-Vehicle Infotainment (IVI) | Create a denial-of-service condition on the system. |
| ZDI-CAN-23249 | CVE-2024-23935 | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-23158 | CVE-2024-25995 | Electric Vehicle Chargers | Execute code in the context of service account. |
| ZDI-CAN-23239 | CVE-2024-26000 | Electric Vehicle Chargers | Disclose sensitive information. |
| ZDI-CAN-23304 | CVE-2024-26001 | Electric Vehicle Chargers | Execute code in the context of service account. |
| ZDI-CAN-23305 | CVE-2024-26002 | Electric Vehicle Chargers | Escalate privileges and execute arbitrary code in the context of root. |
| ZDI-CAN-23102 | CVE-2024-23960 | In-Vehicle Infotainment (IVI) | Bypass signature validation mechanism. |
| ZDI-CAN-23306 | CVE-2024-23961 | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-23190 | CVE-2024-7538 | Operating System | Execute code in the context of root. |
| ZDI-CAN-23195 | CVE-2024-7539 | Operating System | Execute code in the context of root. |
| ZDI-CAN-23193 | Not yet assigned | Operating System | Execute code in the context of root. |
| ZDI-CAN-23246 | CVE-2024-23962 | In-Vehicle Infotainment (IVI) | Disclose sensitive information. |
| ZDI-CAN-23312 | CVE-2024-23963 | In-Vehicle Infotainment (IVI) | Execute code in the context of root. |
| ZDI-CAN-23230 | CVE-2024-23967 | Electric Vehicle Chargers | Execute code in the context of the device. |
| ZDI-CAN-23241 | CVE-2024-23957 | Electric Vehicle Chargers | Execute code in the context of the device. |
| ZDI-CAN-23245 | CVE-2024-24736 | Electric Vehicle Chargers | Execute code in the context of the device. |
| ZDI-CAN-23221 | CVE-2024-25996 | Electric Vehicle Chargers | Execute code in the context of root. |
| ZDI-CAN-23222 | CVE-2024-23968 | Electric Vehicle Chargers | Execute code in the context of root. |
| ZDI-CAN-23313 | CVE-2024-23969 | Electric Vehicle Chargers | Execute code in the context of root. |
| ZDI-CAN-23185 | CVE-2024-23972 | In-Vehicle Infotainment (IVI) | Execute code in the context of the device. |
| ZDI-CAN-23225 | CVE-2024-26288 | Electric Vehicle Chargers | Execute code in the context of root. |
| ZDI-CAN-23320 | CVE-2024-25998 | Electric Vehicle Chargers | Execute code in the context of service account. |
| ZDI-CAN-23321 | CVE-2024-25997 | Electric Vehicle Chargers | Execute code in the context of root. |
| ZDI-CAN-23229 | CVE-2024-23970 | Electric Vehicle Chargers | Execute code in the context of root. |
| ZDI-CAN-23317 | CVE-2024-23971 | Electric Vehicle Chargers | Execute code in the context of root. |
| ZDI-CAN-23226 | CVE-2024-24731 | Electric Vehicle Chargers | Execute code in the context of the device. |
| ZDI-CAN-23151 | Not yet assigned | Electric Vehicle Chargers | Bypass authentication on the system. |
| ZDI-CAN-23318 | CVE-2024-29206 | Electric Vehicle Chargers | Execute code in the context of service account. |
| ZDI-CAN-23223 | Not yet assigned | Electric Vehicle Chargers | Execute code in the context of the device. |
想知道是否有漏洞並受到影響？
聯繫我們進行風險評估 →
利用獨特的零日漏洞察獲得優勢
VicOne 卓越的汽車威脅情報包括儘早獲取有關汽車零日漏洞的重要資訊：
- 獲得早期預警: 我們提供車廠製造商(OEM)、供應商和利害關係人風險評估的能力。我們將先於競爭對手評估您的元件或軟體版本是否受到零日漏洞的影響，從而在規劃期間更好地分配資源。此方法可協助監控新出現的漏洞，符合 ISO/SAE 21434 的精神。
- 獲得早期保護: 我們將評估如何根據攻擊策略、技術和程序與您合作，創建有效的虛擬補丁來保護您的系統。
想知道是否有漏洞並受到影響？
聯繫我們進行風險評估 →
No. 1
自 2007 年年至今在漏洞發現和揭露領域獨步全球*
5+ years
從 2017 年開始，在Pwn2Own與 Tesla 已合作超過 5 年
*資料來源: Omdia 2024年發布的"量化公開漏洞市場"研究報告
從VicOne獲取更多關於汽車零日漏洞的資訊與觀點
深入了解 汽車網路安全
Blog
即使機器人一切運作符合預期，仍可能產生不安全的結果嗎？
Boston Dynamics 與 VicOne 對談：當資訊遭到操控，機器人的正常運作也可能引發安全風險
閱讀更多 →
Blog
BADBOX 相關惡意軟體如何將車用主機變成代理節點
VicOne 深入分析 BADBOX 相關惡意軟體如何利用 DoFun Android 車用主機的 MQTT 通訊弱點與 OTA 更新機制，持續植入惡意程式。
閱讀更多 →
Blog
數千輛車輛暴露於風險之中：零日漏洞揭示車用資安的關鍵盲點
這篇文章分析在主流售後車用裝置中發現的多項零日漏洞，並將其對應至汽車威脅矩陣（Automotive Threat Matrix），進一步說明攻擊者在現實生活中可能如何利用這些關鍵弱點進行攻擊。
閱讀更多 →
Blog
當安全機制成為單點故障：汽車製造商的教訓
本文分析了近期影響某位高奢汽車品牌的車輛癱瘓事件：事件經過、可能發生與未發生的情況，以及汽車製造商如何避免防盜系統影響車輛的可用性和安全性。
閱讀更多 →