Bosch Infotainment ECU Misconfiguration Vulnerability in Nissan Leaf ZE1

A misconfiguration vulnerability has been identified in the infotainment electronic control unit (ECU) of the 2020 Nissan Leaf ZE1. This vulnerability arises during the startup phase of a specific systemd service, inadvertently activating certain developer features. As a result, the firewall is disabled, and the SSH server is launched, potentially allowing unauthorized access or control over the ECU.

Impact

Exploitation of this vulnerability could lead to remote access of the affected ECU, with the firewall disabled and the SSH server enabled, creating a potential vector for unauthorized control or manipulation of the vehicle's systems.