Anti-Theft Bypass for Infotainment ECU

published 2026-01-22 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-4127

cvss: 4.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits: 0; none known

The anti-theft protection mechanism can be bypassed by attackers due to weak response generation algorithms for the head unit. It is possible to reveal all 32 corresponding responses by sniffing CAN traffic or by pre-calculating the values, which allow to bypass the protection.

First identified on Nissan Leaf ZE1 manufactured in 2020.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 9 mo ago (2026-01-22)

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.0	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Affected products

Bosch Infotainment system ECU

Classification

Weakness

CWE-1241 Use of Predictable Algorithm in Random Number Generator

References

nissan.co.uk /vehicles/new-vehicles/leaf.html
product
i.blackhat.com /Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf
media-coverage
pcacybersecurity.com /resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch
technical-description

Sources

CVE List CVE-2025-32056
NVD CVE-2025-32056

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary