Oligo Security hat in seiner „Pwn My Ride“-Analyse vorgestellt, wie die Schwachstelle in AirPlay Angreifern Zugriff auf Fahrzeugsysteme verschaffen kann.
Apple hat das gefixt (im Audio SDK ab 2.7.1, AirPlay Video SDK ab 3.6.0.126 und in den Communication Plug-ins ab R18.1)
Je nach Version sind aber auch sogenannte Zero-Click-Angriffe ohne Nutzerinteraktion möglich.
"A key focus was CVE-2025-24132, a stack buffer overflow vulnerability within the AirPlay protocol that is exposed when a device connects to the car’s multimedia system. We demonstrated several methods to reach the stage where this vulnerability can be triggered and ultimately exploited on devices...
“Not my code” ≠ “Not my problem”
When a vulnerability is discovered in a widely used SDK like Apple’s AirPlay, the challenge isn’t just fixing the bug – it’s ensuring every vendor that depends on the SDK actually implements the fix and gets it to end users. In cars, this is especially difficult. Unlike a phone or laptop that updates overnight, vehicle update cycles are slow, fragmented, and often require a dealership visit or manual USB install. Some head units support over-the-air (OTA) updates, but many still do not.
Even after Apple released a patched SDK, each automaker must adapt, test, and validate it for their own systems – coordinating across head-unit suppliers, internal software teams, and sometimes middleware providers. Each step introduces potential delays and requires robust collaboration"
Hat sonst was von der Heimautomatisierungswelle, wo viele Geräte halt ohne Patches vor sich hinalufen - offen wie ein Scheunentor.