BYD QIN PLUS DM-i Dilink OS Incorrect Access Control Vulnerability Allowing Unauthorized Log Access

A vulnerability in the BYD QIN PLUS DM-i vehicle's Dilink OS version 3.0_13.1.7.2204050.1 has been identified, allowing unauthorized access to system logcat logs. This incorrect access control enables apps to bypass permission restrictions and access sensitive vehicle data, such as location, fuel consumption, VIN, and mileage, which could be uploaded to an external server.

Impact

Exploitation of this vulnerability allows for unauthorized access to confidential vehicle logs, including sensitive data such as location, fuel consumption, VIN, and mileage.

Reproduction

The vulnerability can be reproduced by installing an application on the affected IVI system that requires only normal permissions. Once the application is running, it can access the unprotected system log files, which are stored in the 'logs' directory on the device's storage. The logs can then be extracted and analyzed for sensitive information.

Remediation

This vulnerability has been addressed in the latest version of the BYD QIN PLUS DM-i Dilink OS, where the logs are now encrypted.