CVE-2025-32057: Bosch Infotainment system ECU · Improper Certificate Validation
Affects Bosch Infotainment system ECUSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 22 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| BoschInfotainment system ECU | Affected
| Fixed in– |
AI-suggested
- Bosch should prioritize releasing a firmware update for the affected Infotainment ECU that enforces strict server root certificate validation during TLS handshake, eliminating acceptance of self-signed certificates.
- Nissan and automotive service providers should implement secure update policies that include cryptographic signature verification of update payloads independent of TLS validation to add defense-in-depth.
- Network segmentation and monitoring should be employed to detect anomalous traffic patterns indicative of MITM or spoofing attempts targeting OTA update communications.
- Organizations managing fleets of affected vehicles should establish procedures for manual update verification and incident response in case of suspected compromise.
- Security teams should audit and harden SSL/TLS configurations in automotive ECUs and backend services to avoid default or insecure settings.
- User awareness campaigns can help ensure that vehicle operators understand the importance of applying updates only from trusted sources and reporting suspicious behavior.
- Collaboration with automotive cybersecurity information sharing groups in Europe can facilitate rapid dissemination of patches and threat intelligence related to this vulnerability.
- OEMs should review and enhance their supply chain security requirements to mandate secure cryptographic practices in all embedded systems.
Description
The Infotainment ECU manufactured by Bosch which is installed in Nissan Leaf ZE1 – 2020 uses a Redbend service for over-the-air provisioning and updates. HTTPS is used for communication with the back-end server. Due to usage of the default configuration for the underlying SSL engine, the server root certificate is not verified. As a result, an attacker may be able to impersonate a Redbend backend server using a self-signed certificate. First identified on Nissan Leaf ZE1 manufactured in 2020.