Mercedes-Benz NTG6 Head Unit Command Injection Vulnerability via GCF Protocol

A command injection vulnerability has been identified in the Mercedes-Benz NTG6 head unit, specifically within the GCF (Generic Communication Framework) protocol. This vulnerability arises from an exposed service called 'MonitorService', which is initialized by the 'scp' service. The issue allows an attacker to send crafted requests that are executed as system commands, potentially leading to unauthorized actions on the vehicle's network or systems.

Impact

Exploitation of this vulnerability allows for command injection via the GCF protocol, enabling attackers to execute arbitrary commands on the head unit's operating system.

Reproduction

The vulnerability can be reproduced by connecting to the head unit's internal network through the Base Board Ethernet pins. Once connected, access the 'MonitorService' over GCF. The 'NWS_PF_setMacAddrExceptionIP' handler can be targeted, as it lacks proper validation and allows for injection of commands that are executed with system privileges.