CVE-2025-32063 Overview
CVE-2025-32063 is a misconfiguration vulnerability in the Infotainment Electronic Control Unit (ECU) manufactured by BOSCH, first identified on the Nissan Leaf ZE1 model year 2020. During the startup phase of a specific systemd service, the system activates developer features that should remain disabled in production. Specifically, the firewall is disabled and an SSH server is launched on the ECU. An attacker with physical access to the vehicle's infotainment system can leverage these exposed services to interact with the ECU at the operating system level. The weakness is classified as [CWE-306] Missing Authentication for Critical Function.
Critical Impact
An attacker with physical access to the infotainment ECU can reach an unauthenticated SSH service without firewall protection, enabling full compromise of confidentiality, integrity, and availability on the targeted unit.
Affected Products
- BOSCH Infotainment ECU (as deployed in affected Nissan vehicles)
- Nissan Leaf ZE1 (2020 model year, first identified platform)
- Vehicle variants sharing the same BOSCH infotainment firmware baseline
Discovery Timeline
- 2026-02-15 - CVE-2025-32063 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-32063
Vulnerability Analysis
The infotainment ECU runs a Linux-based operating system managed by systemd. During boot, a specific service unit executes with a configuration intended for development and debugging rather than production. The service disables the host firewall and starts an SSH daemon that remains reachable on internal vehicle network interfaces exposed through the infotainment stack.
Because the SSH service is launched without the authentication hardening required for a shipped product, an attacker who can reach the ECU over a physical interface such as USB, diagnostic ports, or exposed debug headers can establish an interactive session. From there, the attacker can read sensitive data stored on the unit, modify configuration files, or pivot into other vehicle subsystems connected to the infotainment ECU. Full technical context is available in the Black Hat Asia 2025 presentation on remote exploitation of the Nissan Leaf and the PCA Cyber Security advisory.
Root Cause
The root cause is an insecure default configuration shipped in production firmware. A systemd unit intended to support developer workflows was not disabled before release. The unit explicitly tears down firewall rules and starts an SSH listener, violating the principle of least functionality for an embedded automotive component.
Attack Vector
Exploitation requires physical proximity to the vehicle and access to an interface that exposes the infotainment ECU's network stack. After the ECU completes its boot sequence, the attacker connects to the running SSH service. Because the firewall is disabled during the same startup phase, no network-layer control blocks the connection attempt.
No verified proof-of-concept code is published for this specific misconfiguration. Refer to the external advisories listed above for the technical walkthrough.
Detection Methods for CVE-2025-32063
Indicators of Compromise
- Unexpected SSH listener bound on the infotainment ECU after boot, visible through diagnostic tooling.
- Firewall state showing no active ruleset (for example, empty iptables or nftables tables) during normal vehicle operation.
- systemd journal entries indicating activation of a developer-oriented service unit on production firmware.
Detection Strategies
- Audit firmware images for enabled development services and compare active systemd units against the approved production manifest.
- Perform port scanning of the infotainment ECU over authorized physical interfaces to detect exposed SSH or other administrative services.
- Review build pipelines to confirm developer unit files are stripped or masked before signing release firmware.
Monitoring Recommendations
- Collect boot logs from fleet vehicles during service visits and flag any instance where firewall shutdown or SSH startup is recorded.
- Monitor for unauthorized connections on internal vehicle network segments that terminate at the infotainment ECU.
- Track firmware versions deployed across the fleet to identify units still running the vulnerable baseline.
How to Mitigate CVE-2025-32063
Immediate Actions Required
- Contact the vehicle manufacturer or authorized dealer to confirm whether a firmware update addressing the BOSCH infotainment misconfiguration is available.
- Restrict physical access to diagnostic ports and interfaces that expose the infotainment ECU network stack.
- Inventory affected vehicles in corporate or fleet environments and prioritize them for the vendor remediation program.
Patch Information
No specific patch identifier is published in the NVD record for CVE-2025-32063. Owners and fleet operators should follow guidance issued by Nissan and BOSCH through official service channels. Monitor the PCA Cyber Security advisory for updates on remediation availability.
Workarounds
- Limit physical access to the vehicle cabin and OBD-II or USB ports that interface with the infotainment ECU.
- Where supported by the vendor, disable or mask the developer systemd unit that disables the firewall and starts SSH.
- For research or test fleets, isolate affected ECUs from other vehicle network segments until updated firmware is installed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.