Mercedes-benz vulnerabilities
We track 6 vulnerabilities in Mercedes-benz products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on February 13, 2025.
Latest Mercedes-benz vulnerabilities
- 7.7 High severity
Headunit Ntg6 Mercedes-benz User Experience: Out-of-bounds Write
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside file is encapsulate another file, which service will drop during processing. Due to missed checks, attacker can achieve Arbitrary File Write with service spee
- 7.5 High severity
Headunit Ntg6 Mercedes-benz User Experience: NULL Pointer Dereference
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. In case of parsing file, service try to define header inside the file and convert it to null-terminated string. If character is missed, will return null pointer.
- 9.8 Critical severity
Headunit Ntg6 Mercedes-benz User Experience: Integer Overflow or Wraparound
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost library. The version of boost library contains vulnerability integer overflow.
- 7.5 High severity
Headunit Ntg6 Mercedes-benz User Experience: NULL Pointer Dereference
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost library. The boost library contains a vulnerability/null pointer dereference.
- 7.5 High severity
Headunit Ntg6 Mercedes-benz User Experience: Uncontrolled Resource Consumption
Mercedes Benz head-unit NTG 6 contains functions to import or export profile settings over USB. During parsing you can trigger that the service will be crashed.
- 7.5 High severity
Xentry Retail Data Storage Firmware: Uncontrolled Resource Consumption
Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated API request. The attacker must be on the same network as the device.