Unpatched Mazda Connect bugs let hackers install persistent malware

Trend Micro ZDI disclosed six unpatched vulnerabilities in Mazda Connect infotainment units (firmware 74.00.324A) — CVE-2024-8355, CVE-2024-8359, CVE-2024-8360, CVE-2024-8358, CVE-2024-8357, and CVE-2024-8356 — that include SQL injection, multiple command injection flaws, a missing root of trust, and unsigned MCU code; an attacker with physical access (e.g., USB and potentially vehicle key according to Mazda) can deploy crafted updates within minutes to gain root-level code execution, persistence, and potential access to vehicle CAN buses and ECUs, posing safety and operational risks.