Multiple flaws in Volkswagen Group’s infotainment unit allow for vehicle compromise

Researchers from PCAutomotive disclosed a set of vulnerabilities in VW Group MIB3 infotainment units (including units by Preh Car Connect GmbH) that could allow unauthenticated attackers in proximity to exploit Bluetooth/phonebook parsing and other services to cause code execution, track vehicles in real time, access GPS and contacts, monitor speed, record in-car conversations, and more; 12 CVEs are listed, a video PoC was published, and the vendor reports some fixes are deployed while others are being addressed.