CVE-2018-9320: The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series...

Security readout for executives and security teams

CVE-2018-9320 concerns BMW HU_NBT infotainment head units in listed BMW series vehicles produced from 2012 through 2018. The weakness allows a local attack when a USB device is plugged in. Public sources do not provide a CVSS score, CWE, confirmed exploitation, or specific vendor fix in the supplied bundle. Exposure is most relevant to organizations operating or servicing affected BMW vehicles where untrusted people can access cabin USB ports. Risk is lower for privately controlled vehicles, but fleets, rentals, workshops, and shared executive transport should treat physical USB access as a meaningful control point. Prioritize this for fleets, executive transport, rentals, and service environments where many people can access vehicle interiors. The business issue is physical tampering risk, not confirmed internet-scale exploitation. Act through inventory, USB-use controls, and vendor guidance review. Mitigation focus: Check BMW or dealer service guidance for HU_NBT software updates or recalls.; Restrict physical access to vehicle USB ports where practical.; Prohibit untrusted USB media in affected vehicles and service workflows..

Prepared

Jun 7, 2026, 13:21 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.