CVE-2023-26243

7.8 HIGH

An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214

Published: 2023-04-27 · Last updated: 2026-06-04

Severity and scoring

CVSS: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-22, CWE-269

Affected products

Vendor	Product
hyundai	gen5w_l_firmware

Description

An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The decryption binary used to decrypt firmware files has an information leak that allows an attacker to read the AES key and initialization vector from memory. An attacker may exploit this to create custom firmware that may be installed in the IVI system. Then, an attacker may be able to install a backdoor in the IVI system that may allow him to control it, if it is connected to the Internet through Wi-Fi.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2023-26243
[Other]https://sowhat.iit.cnr.it
[Exploit reference]https://sowhat.iit.cnr.it:8443/can-work/chimaera
[Exploit reference]https://sowhat.iit.cnr.it:8443/can-work/chimaera/-/blob/main/Report/IIT-01-2023.pdf
[Other]https://sowhat.iit.cnr.it
[Exploit reference]https://sowhat.iit.cnr.it:8443/can-work/chimaera
[Exploit reference]https://sowhat.iit.cnr.it:8443/can-work/chimaera/-/blob/main/Report/IIT-01-2023.pdf

Related CVEs

Same vendor

CVE-2023-26246 — An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214 (7.8 HIGH)
CVE-2023-26245 — An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214 (7.8 HIGH)
CVE-2023-26244 — An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214 (7.8 HIGH)

Same CWE

CVE-2026-48777 — FileBrowser Quantum is a free, self-hosted, web-based file manager
CVE-2024-38487 — api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unint... (7.0 HIGH)
CVE-2026-12313 — Information disclosure, sandbox escape in the Security: Process Sandboxing component (4.7 MEDIUM)
CVE-2026-12289 — Privilege escalation in the Graphics: WebRender component (8.8 HIGH)
CVE-2026-8442 — The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8 (8.1 HIGH)