[Geraner]

Hi,

Just found his news on the internet.
Flaws in BMW ConnectedDrive Infotainment System allow remote hack

• BMW ConnectedDrive - (Update) VIN Session Vulnerability
• BMW - (Token) Client Side Cross Site Scripting Vulnerability

Amazingly:
"The security flaws have been reported to BMW in February, unfortunately, there was news about the availability of a fix."

I have contacted the Swedish BMW Customer Service for a comment on this.

/Geraner

[KPD]

Originally Posted by Geraner

Hi,

Just found his news on the internet.
Flaws in BMW ConnectedDrive Infotainment System allow remote hack

• BMW ConnectedDrive - (Update) VIN Session Vulnerability
• BMW - (Token) Client Side Cross Site Scripting Vulnerability

Amazingly:
"The security flaws have been reported to BMW in February, unfortunately, there was news about the availability of a fix."

I have contacted the Swedish BMW Customer Service for a comment on this.

/Geraner

Thanks for the heads up. Not much us owners can do to be honest, other than contacting BMW and demanding answers and publicly shaming them on Twitter. I doubt they're going to reply to private emails. If they do, it'd be a generic nonsense like "we value your feedback, blah blah blah".