Hyundai Motor America Blue Link ICSA-17-115-03 Multiple Security Vulnerabilities

Bugtraq ID:	98033
Class:	Unknown
CVE:	CVE-2017-6052 CVE-2017-6054
Remote:	Yes
Local:	No
Published:	Apr 25 2017 12:00AM
Updated:	May 02 2017 12:10AM
Credit:	Will Hatzer and Arjun Kumar working with Rapid7.
Vulnerable:	Hyundai Blue Link 3.9.5 Hyundai Blue Link 3.9.4
Not Vulnerable:

Hyundai Motor America Blue Link ICSA-17-115-03 Multiple Security Vulnerabilities

Hyundai Motor America Blue Link is prone to the following multiple security issues:

1. An information disclosure vulnerability
2. A security-bypass vulnerability

An attacker may leverage these issues to gain sensitive information and bypass certain security restrictions and perform unauthorized actions.

Blue Link version 3.9.5 and 3.9.4 are vulnerable.

Hyundai Motor America Blue Link ICSA-17-115-03 Multiple Security Vulnerabilities

An attacker can use readily available tools to exploit the security bypass issue.

Hyundai Motor America Blue Link ICSA-17-115-03 Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Hyundai Motor America Blue Link ICSA-17-115-03 Multiple Security Vulnerabilities

References:

• Hyundai Motor America Homepage (Hyundai Motor America)
  
• ICSA-17-115-03:Hyundai Motor America Blue Link (CERT)