CVE-2025-45584: Audi UTR · Improper Access Control
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 35% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 12 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, European organizations should immediately assess their exposure by identifying all Audi UTR 2.0 devices deployed within their infrastructure. Network segmentation should be employed to isolate these devices from public or less trusted networks, restricting access to authorized personnel only. Implementing strict firewall rules to block unauthorized inbound traffic to the web service interface is critical. Since no official patches are currently available, organizations should engage with Audi or the device vendor to obtain security updates or guidance. In parallel, monitoring network traffic for unusual access patterns to the UTR 2.0 web service can help detect potential exploitation attempts. Where possible, disabling the web service interface or restricting it to internal networks until a patch is released can reduce risk. Additionally, organizations should review and enhance their incident response plans to include scenarios involving automotive device compromise. Finally, advocating for and participating in coordinated vulnerability disclosure programs with the vendor can accelerate remediation efforts.
Description
Incorrect access control in the web service of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to download car information without authentication.