Temppu puree laitteisiin joissa on käytetty saksalaisen OpenSynergyn BlueSDK-protokollapinoa, käyttäjiä ovat mm. Volkswagen, Skoda ja Mercedes-Benzin MBUX-sukupolven laitteet (tai ainakin osa niistä).
Korjaava OTA-päivitys on saksalaisen blogin mukaan kohta tulossa: https://mbpassion.de/2025/07/mercedes-b ... t5ykVfRsMg
Lisätietoa löytää taikasanoilla "PerfektBlue" ja "BlueSDK" hakemalla. ChatGPT kertoo seuraavaa:
The Four Chained Vulnerabilities1. CVE‑2024‑45434 – Use‑After‑Free in AVRCP
• Occurs when the AVRCP service acts on freed objects, allowing an attacker to overwrite memory and hijack code execution .
• This is the most critical flaw (CVSS 8.0) and is the primary code-execution vector.
2. CVE‑2024‑45431 – L2CAP Channel ID Validation Flaw
• L2CAP fails to validate remote channel identifiers, enabling attackers to bypass protocol safety checks .
3. CVE‑2024‑45433 – RFCOMM Incorrect Function Termination
• RFCOMM handler doesn’t properly handle certain termination conditions, creating a route to gain entry into other flaws .
4. CVE‑2024‑45432 – RFCOMM Parameter Mishandling
• A function uses an incorrect variable for a parameter, causing memory corruption or data leaks  .
These are exploited sequentially: the attacker sets up controlled memory and channel conditions using L2CAP/RFCOMM errors, then triggers AVRCP UAF to achieve code execution .
⸻
Attack Conditions & Impact• User interaction: Usually minimal—just pairing approval .
• Proof-of-concept exploits demonstrated on infotainment systems from Mercedes (NTG6/NTG7), Volkswagen (ICAS3), and Škoda (MIB3) .
• Possible outcomes:
• RCE at user-level on IVI systems
• Exfiltration of GPS, audio, contacts
• Potential (though unproven) lateral movement to critical vehicle ECUs 
⸻
Why is BlueSDK Vulnerable?• BlueSDK is a closed-source Bluetooth stack framework, used across multiple vendors
• Different OEMs configure it variably (pairing modes, security settings), leading to inconsistent defenses 
• PerfektBlue exploits this fragmentation and allows streaming of attack across product lines
⸻
Mitigation / Status• OpenSynergy released patches in September 2024 
• OEMs began deploying the updates mid-2025, though some vehicles remained unpatched by July 2025 
• Short-term mitigation: disable Bluetooth if updates aren’t available
⸻
SummaryPerfektBlue is a serious Bluetooth exploit chain that leverages four vulnerabilities (AVRCP, L2CAP, RFCOMM) in BlueSDK to achieve one-click RCE on automotive infotainment systems. It affects millions of vehicles globally and highlights risks inherent in modular, vendor-driven Bluetooth stacks.
⸻