The Blue SDK, developed by German manufacturer OpenSynergy, has been revealed to contain known vulnerabilities collectively termed as “PerfektBlue,” which have persisted since 2024 despite awareness of these issues. Recent security researchers demonstrated the ability to launch attacks on entertainment systems via Bluetooth against vehicles from Mercedes-Benz, Volkswagen Group brands including VW and Skoda, making them still susceptible to such exploits.
In May 2024, PCA Cyber Security (formerly PCAutomotive) alerted OpenSynergy about potential vulnerabilities aggregated under the term PerfektBlue. According to information provided by OpenSynergy, these issues have been addressed, and corresponding patches were made available to customers in September 2024. However, if manufacturers fail to incorporate updated Blue SDK firmware into their products or miss out on security updates, vehicles can remain vulnerable.
PCA Cyber Security’s assessment team discovered several vulnerabilities (CVE-2024-45431, CVE-2024-45432, CVE-2024-45433, and CVE-2024-45434) that enable remote code execution through a single-click attack on devices using the Blue SDK Bluetooth stack. Successful exploitation could allow attackers to manipulate systems, escalate privileges, and access other vehicle components. Researchers successfully demonstrated such attacks on Infotainment systems in Volkswagen ID.4, Mercedes-Benz NTG6, and Skoda MIB3 vehicles.
While these vulnerabilities pose significant risks for compromising GPS coordinates, overhearing conversations, accessing phone contacts, and potentially moving to more critical subsystems within the car, the specific conditions under which these exploits can occur suggest a limited attack surface. Volkswagen stated that an attacker must have Bluetooth pairing enabled, be within 5-7 meters of the vehicle, and receive explicit permission from the user for access.
Mercedes-Benz confirmed receiving information about this issue in November 2024 and implemented necessary measures based on OpenSynergy’s updates to the BlueSDK library. Over-the-air updates are also available for application.
The Risks Lurking Within Modern Vehicles: A Deep Dive
The growing reliance on connected technology has brought both benefits and security concerns to modern vehicles. In a recent Hacker Challenge event, Pwn2Own 2025, participants identified numerous zero-day vulnerabilities in software-defined vehicles (SDVs), highlighting the complex challenges manufacturers face in securing these systems. Moreover, BleepingComputer reported a case where researchers successfully attacked infotainment systems of vehicles from major brands like Mercedes-Benz and Volkswagen via the Blue SDK.
The article also mentions that Pen Test Partners managed to access driving, braking, and acceleration data on a Renault Clio from 2016 during an independent security test. Furthermore, Heise has highlighted a zero-day Bluetooth vulnerability affecting millions of headsets, turning them into eavesdropping devices. The automotive industry’s increased focus on software-defined vehicles (SDVs) as a means to enhance profit margins while integrating cutting-edge technology underscores the necessity for robust security measures.
Similar questions
What are the main vulnerabilities found in the Blue SDK?
Who discovered these vulnerabilities and when were they reported?
How did OpenSynergy respond to the discovery of these issues?
Which car manufacturers’ vehicles are affected by these vulnerabilities?
Are there specific CVE numbers assigned to these vulnerabilities?
Can attackers gain control over other vehicle components through PerfektBlue?
What kind of information can be accessed by exploiting these vulnerabilities?
Why is the attack surface considered limited according to Volkswagen’s statement?
How do car manufacturers ensure that their vehicles are not vulnerable to PerfektBlue?
Are there any ongoing efforts to further mitigate these risks?