This week, Ford disclosed having a security bug in its SYNC3 infotainment that lets an attacker within the Wi-Fi range of the car hack it remotely.
A patch for this bug is in the works, says Ford, which can be downloaded and installed via USB when available. The company further states that it found no evidence of this bug’s exploitation in the wild, yet, while also assuring that the driver’s safety isn’t compromised even in the worst case.
Exposed to RCE Attacks
Ford, the American automobile manufacturer, has disclosed a security issue with some of its cars, which have the SYNC3 infotainment system fitted in. Tracked as CVE-2023-29468, this bug may let a perpetrator take over the vehicle’s infotainment system in the Wi-Fi range.
SYNC3 initially discovered this as a buffer overflow vulnerability in the WL18xx MCP driver of its infotainment’s WiFi subsystem. And since many Ford and Lincoln vehicles use the SYNC3 infotainment system, they’re all affected, with some being;
- Ford EcoSport (2021 – 2022)
- Ford Escape (2021 – 2022)
- Ford Bronco Sport (2021 – 2022)
- Ford Explorer (2021 – 2022)
- Ford Maverick (2022)
- Ford Expedition (2021)
- Ford Ranger (2022)
- Ford Transit Connect (2021 – 2022)
- Ford Super Duty (2021 – 2022)
- Ford Transit (2021 – 2022)
- Ford Mustang (2021 – 2022)
- Ford Transit CC-CA (2022)
An attacker exploiting this bug must be in the car’s WiFi range and trigger the buffer overflow using a specially crafted frame. Since it requires a physical presence nearby, the car’s ignition and Wi-Fi to be turned on, and a high level of sophistication to hack, Ford says it’s not a severe issue.
Anyhow, SYNC3 took immediate action to validate it, estimate the impact, and develop mitigation measures for this bug. The same is shared with Ford, which is now making a patch update. While it takes a while to be available, Ford says the customers can manually install it in their cars via a USB.
Saying that it found no evidence of this bug’s exploitation yet, Ford assured the driver safety even in the worst case of exploitation, as the “infotainment system is firewalled from controls like steering, throttling and braking.”
