An issue was discovered in the Daimler Mercedes-Benz Me app 2.11.0-846 for iOS.
Priority LOW 36CWE-319Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-319.
Summary
An issue was discovered in the Daimler Mercedes-Benz Me app 2.11.0-846 for iOS. The encrypted Connected Vehicle API data exchange between the app and a server might be intercepted. The app can be used to operate the Remote Parking Pilot, unlock the vehicle, or obtain sensitive information such as latitude, longitude, and direction of travel.
Why it matters now
EPSS 0.01409 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mercedes-benz:mercedes_me:2.11.0:*:*:*:*:iphone_os:*:* | 2.11.0 | Vulnerable | Mercedes-benz |
- cpe:2.3:a:mercedes-benz:mercedes_me:2.11.0:*:*:*:*:iphone_os:*:* Versions 2.11.0 Vulnerable ·Mercedes-benz
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-18071
- 2026-10-03 Alias added: GHSA-v39m-fc2p-hp53
References
More Mercedes-benz Mercedes Me vulnerabilities
- TI-2023-25640 An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view… CVSS 3.1MEDIUM 5.3
- TI-2023-25639 An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view… CVSS 3.1MEDIUM 5.3
Sources
- CVE-2018-18071 · CVE Program
- CVE-2018-18071 · NVD
- FIRST EPSS
- GHSA-v39m-fc2p-hp53 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences