CVE-2025-32058
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThe Infotainment ECU manufactured by Bosch uses a RH850 module for CAN communication. RH850 is connected to infotainment over the INC interface through a custom protocol. There is a vulnerability during processing requests of this protocol on the V850 side which allows an attacker with code execution on the infotainment main SoC to perform code execution on the RH850 module and subsequently send arbitrary CAN messages over the connected CAN bus. First identified on Nissan Leaf ZE1 manufactured in 2020.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceA vulnerability in the custom protocol processing on the V850 side of the INC interface between the infotainment main SoC and the RH850 CAN controller module allows an attacker with code execution on the infotainment ECU to achieve code execution on the RH850, enabling transmission of arbitrary CAN messages.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Local
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify the infotainment ECU hardware architectureExamine the vehicle's infotainment system documentation or firmware to determine if it uses a V850 microcontroller in conjunction with an RH850 CAN controller module via an INC interfaceAffected if The system uses a V850-to-RH850 INC interface for CAN communication between the infotainment SoC and the CAN controller
-
Determine if the infotainment ECU has code execution exposureAudit the infotainment ECU attack surface: review network-facing services, USB handling, Bluetooth stack, media parsing, and any third-party applications running on the infotainment systemAffected if The infotainment ECU accepts untrusted external inputs (network, USB, Bluetooth, media files) that could provide an attacker with initial code execution capability
-
Verify CAN bus message integrity monitoringInspect CAN bus traffic logs or intrusion detection system alerts for any anomalous CAN messages, especially those originating from the infotainment ECU that are outside expected behavior patternsAffected if Arbitrary or unexpected CAN messages are being transmitted from the infotainment ECU that do not match known legitimate message sequences
-
Check for firmware version informationLocate firmware version strings or build metadata in the infotainment ECU firmware image, particularly for the V850 protocol handling componentsAffected if The installed V850 firmware version predates any vendor patch addressing this custom protocol vulnerability
-
Assess network isolation of infotainment ECUReview network segmentation configuration to determine if the infotainment ECU is isolated from untrusted external networks or if it has direct IP connectivityAffected if The infotainment ECU is directly accessible from untrusted networks without isolation barriers
A system is affected if it utilizes a V850-based INC interface to communicate with an RH850 CAN controller and the infotainment ECU is vulnerable to code execution attacks, allowing an attacker to send arbitrary CAN messages.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataApply vendor firmware patches when available; until then, isolate the infotainment ECU from untrusted external inputs and monitor CAN bus traffic for anomalous messages that could indicate exploitation.
- Consultation10.0 h
- Implementation20.0 h
- Testing16.0 h
- Review / QA6.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $14,528.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-32058 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-32058 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data