What is the CVSS score of CVE-2023-34401?

CVE-2023-34401 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Headunit Ntg6 Mercedes Benz User Experience are affected by CVE-2023-34401?

CVE-2023-34401 is a low-severity vulnerability in Mercedes-Benz head-unit NTG6 involving out-of-bounds read (CVSS 3.7).

How to fix or mitigate CVE-2023-34401?

During next maintenance window: Apply vendor patches when convenient. Verify out-of-bounds read controls are in place.

Headunit Ntg6 Mercedes Benz User Experience CVE-2023-34401

LOW

Out-of-bounds Read (CWE-125)

2025-02-13 cve@mitre.org

Information Disclosure Buffer Overflow Headunit Ntg6 Mercedes Benz User Experience

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:26 vuln.today

CVE Published

Feb 13, 2025 - 23:15 nvd

LOW 3.7

DescriptionCVE.org

Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside profile folder there is a file, which is encoded with proprietary UD2 codec. Due to missed size checks in the enapsulate file, attacker can achieve Out-of-Bound Read in heap memory.

AnalysisAI

Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Out-of-bounds Read (CWE-125), which allows attackers to read data from memory outside the intended buffer boundaries. Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside profile folder there is a file, which is encoded with proprietary UD2 codec. Due to missed size checks in the enapsulate file, attacker can achieve Out-of-Bound Read in heap memory. Affected products include: Mercedes-Benz Headunit Ntg6 Mercedes-Benz User Experience.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate array indices and buffer lengths. Use memory-safe languages. Enable AddressSanitizer during testing.