CVE-2025-32060
MEDIUM EPSS 1.6%
Published Feb 15, 20264mo ago · Modified Jun 17, 20261w ago
6.7 CVSS 3.1
Published Feb 15, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago
Description
The system suffers from the absence of a kernel module signature verification. If an attacker can execute commands on behalf of root user (due to additional vulnerabilities), then he/she is also able to load custom kernel modules to the kernel space and execute code in the kernel context. Such a flaw can lead to taking control over the entire system. First identified on Nissan Leaf ZE1 manufactured in 2020.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector Local
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
1.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-347
References 3
- i.blackhat.com http://i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remote-Exploitation-of-Nissan-Leaf.pdf
- pcacybersecurity.com https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-nissan-infotainment-manufactured-by-bosch
- nissan.co.uk https://www.nissan.co.uk/vehicles/new-vehicles/leaf.html
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.