Security readout for executives and security teams
Plain-English summary
This issue affects Mercedes-Benz NTG6 head-units that can import or export profile settings using USB. A malformed profile file using the proprietary UD2 codec may cause the unit to read memory outside its intended bounds. The public record rates it low severity and does not identify active exploitation.
Executive priority
Treat as a low-priority fleet security maintenance item, not an emergency. The main action is confirming exposure and following vendor guidance, especially for high-value or research-facing vehicles.
Technical view
CVE-2023-34401 is a CWE-125 out-of-bounds read in heap memory tied to missing size checks while processing a UD2-encoded profile file inside the NTG6 profile folder. The CVSS 3.1 score is 3.7, with low confidentiality and integrity impact and no availability impact.
Likely exposure
Exposure appears limited to Mercedes-Benz vehicles or test environments using NTG6 head-units with USB profile import/export functionality. The source bundle does not provide affected models, firmware versions, CPEs, or fleet scope.
Exploitation context
The CVE record reports high attack complexity, required privileges, and user interaction. KEV status is false, and the provided sources do not state active exploitation or public weaponization.
Researcher notes
Evidence is limited. The bundle identifies the vulnerable parsing area and CVSS details but lists affected vendor, product, versions, and CPEs as n/a. No patch, workaround, or exploit-in-the-wild evidence is provided.
Mitigation direction
- Check Mercedes-Benz or head-unit vendor guidance for affected firmware and updates.
- Apply approved head-unit firmware updates when available through authorized service channels.
- Restrict use of untrusted USB media with vehicle head-units.
- Disable or control profile import/export workflows where operationally feasible.
- Document fleet handling procedures for removable media in vehicles.
Validation and detection
- Inventory vehicles or lab units that contain NTG6 head-units.
- Confirm whether USB profile import/export is available or used.
- Check firmware status against Mercedes-Benz or authorized service guidance.
- Review fleet policy for untrusted USB use in vehicle systems.
- Track the CVE record for affected version or remediation updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-34401 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N1.22.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.7LowVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://securelist.com/mercedes-benz-head-unit-security-research/115218/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.