CVE-2023-29389 describes a critical vulnerability in 2021 Toyota RAV4 vehicles where the CAN bus automatically trusts messages from other ECUs. This allows a physically proximate attacker to gain full control of the vehicle by sending forged "Key is validated" messages via CAN injection after accessing the headlight connector. With a CVSS score of 6.8 (Medium), the attack requires physical access but is low complexity, leading to high confidentiality, integrity, and availability impacts. This vulnerability has been actively exploited in the wild, as evidenced by incidents in July 2022 and media coverage, despite no public exploit code or Metasploit modules being available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2021CPE matchmatch criteria | cpe:2.3:o:toyota:rav4_firmware:2021:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.