CVE-2023-28909

CVE-2023-28909 is a high-severity vulnerability in the Bluetooth stack of certain MIB3 infotainment units, such as those found in Skoda Superb III cars. It stems from improper validation of user-supplied data, leading to an integer overflow when processing fragmented HCI packets. This flaw allows an attacker to bypass MTU checks, resulting in a buffer overflow in upper layer profiles, which can ultimately lead to remote code execution. The vulnerability has a CVSS score of 8.0 (High), indicating a network-adjacent attack vector with low attack complexity, requiring no user interaction, and potentially leading to high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.