CVE-2025-32063 is a vulnerability classified under CWE-306 (Missing Authentication for Critical Function) affecting the Bosch Infotainment system ECU, specifically identified in Nissan Leaf ZE1 vehicles manufactured in 2020. The root cause is a misconfiguration during the startup phase of a particular systemd service within the ECU. This misconfiguration inadvertently activates developer features that should remain disabled in production environments: it disables the firewall and launches an SSH server without requiring authentication. The absence of authentication on the SSH server means that any attacker with network access to the infotainment system can connect remotely without credentials. This unauthorized access can lead to full compromise of the infotainment ECU, allowing attackers to manipulate vehicle functions, extract sensitive data, or disrupt vehicle operations. The CVSS v3.1 score is 6.8, reflecting medium severity with high impact on confidentiality, integrity, and availability, but requiring local network access (AV:P - physical or adjacent network) and no privileges or user interaction. No public exploits are known at this time, but the vulnerability's nature makes it a critical concern for automotive cybersecurity. The affected version is identified as 283C30861E, and no official patches have been published yet. The vulnerability was reserved in April 2025 and published in February 2026. The technical details emphasize the risk of enabling developer features in production ECUs, highlighting a significant security oversight in Bosch's software configuration management.

For European organizations, particularly automotive manufacturers, suppliers, and service providers, this vulnerability presents a substantial risk. The infotainment ECU is a critical component interfacing with vehicle systems and potentially connected to other in-vehicle networks. Exploitation could lead to unauthorized remote access, allowing attackers to manipulate vehicle functions, compromise user privacy by accessing stored data, or disrupt vehicle availability by disabling or altering system behavior. This could result in safety hazards for drivers and passengers, reputational damage for manufacturers, and regulatory scrutiny under EU cybersecurity and automotive safety regulations. Fleet operators and car-sharing services using affected Nissan Leaf models may face operational disruptions and increased risk of cyberattacks. Additionally, the disabled firewall and open SSH server increase the attack surface, potentially enabling lateral movement to other vehicle systems or connected infrastructure. The lack of authentication and ease of exploitation within the vehicle's local network environment elevate the threat level, especially in scenarios where attackers gain physical proximity or remote access via compromised telematics or infotainment connectivity.

1. Immediate network segmentation: Isolate the infotainment ECU from external and less trusted networks to limit attacker access to the vulnerable SSH service. 2. Monitor network traffic for unauthorized SSH connections and unusual activity on the infotainment ECU. 3. Disable or restrict SSH access on the ECU if possible through configuration changes or administrative controls. 4. Coordinate with Bosch and Nissan to obtain and deploy firmware updates or patches addressing the misconfiguration. 5. Implement strict access controls and authentication mechanisms for all developer and diagnostic interfaces in vehicle ECUs. 6. Conduct thorough security audits of ECU startup configurations to prevent accidental enabling of developer features in production. 7. Educate service personnel and end-users about the risks of connecting untrusted devices to the vehicle network. 8. For fleet operators, enforce policies restricting physical and network access to vehicles and their infotainment systems. 9. Engage in continuous vulnerability management and incident response planning specific to automotive cybersecurity threats. 10. Advocate for industry-wide best practices and standards to prevent similar misconfigurations in automotive ECUs.