Security vulnerability

Ford Discussion
1
1 Like
2

Interesting. I wonder what they changed in the 2021 modules that make them vulnerable.

3

A buffer overflow vulnerability in the SYNC3 onboard entertainment system used in Ford vehicles could be exploited to achieve remote code execution and potentially hijack the system. Ford recommends disabling the system’s WiFi until a fix is available, and that its vehicles are safe to drive despite the security issue. Ford is currently developing a patch that customers can download and install with a USB. Once the fix is available, customers should be able to connect their cars’ entertainment systems to a network and receive the patch over the air, if they choose.

SYNC Region: NA

Navigation Variant: Nav

Manufacturer Year: Pre MY20

Install Type: OEM Replacement

Old SYNC Version: 3.4

New SYNC Version: 3.4

Do you have a error message, if so what is it?

Update Method: Official Ford

4

Hey there, I’ve merged your original thread into this one which was already opened.

Thanks!.

1 Like
5

I don’t consider this very concerning. Unless you are someone super important the chance of you being targeted seems unlikely, and if you are important you ain’t driving a ford :rofl:, according to ford and my understanding it can’t do anything like remotely control the car only the sync system so no danger in that regard either.

Technical information relating to this CVE
The Texas Instruments (TI) WiLink WL18xx MCP driver does not limit the number of information elements (IEs) of type XCC_EXT_1_IE_ID or XCC_EXT_2_IE_ID that can be parsed in a management frame. Using a specially crafted frame, a buffer overflow can be triggered that can potentially lead to remote code execution. This affects WILINK8-WIFI-MCP8 version 8.5_SP3 and previous versions.

Potentially Impacted Features
An attacker within wireless range of a potentially vulnerable device can gain the ability to overwrite memory of
the host processor executing the MCP driver.

6

Not that I see this as a threat to owners, just more informative. Also patiently waiting for next update, hopefully encourage otherst o update when its released.