DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECU
Priority MEDIUM 61CWE-20Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00393 33rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ID.3 (Volkswagen): 3.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Volkswagen | ID.3 | before 3.2 | 3.2 | Patch available | CNA |
- ID.3 VendorVolkswagen Affected before 3.2 Fixed in 3.2 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:volkswagen:id.3_firmware:*:*:*:*:*:*:*:* | before 3.2 | Vulnerable | Volkswagen |
| cpe:2.3:h:volkswagen:id.3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Volkswagen |
- cpe:2.3:o:volkswagen:id.3_firmware:*:*:*:*:*:*:*:* Versions before 3.2 Vulnerable ·Volkswagen
- cpe:2.3:h:volkswagen:id.3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Volkswagen
Remediation
- Fix · CNA ID.3 (Volkswagen) Fixed in 3.2
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6073
- 2026-10-03 Alias added: GHSA-35gc-287r-3fpq
References
Sources
- CVE-2023-6073 · CVE Program
- CVE-2023-6073 · NVD
- FIRST EPSS
- GHSA-35gc-287r-3fpq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences