CVE-2019-19556: 
NixOS vulnerability analysis and mitigation

An authentication bypass vulnerability (CVE-2019-19556) was discovered in the debug interface of Mercedes-Benz HERMES 1 (Hardware for Enhanced Remote-, Mobility- & Emergency Services). The vulnerability allows attackers with physical access to device hardware to obtain system information (NVD, CVE).

The vulnerability was discovered in the HERMES Telematics Control Unit (TCU), which serves as a critical communication intermediary between the external network and the in-vehicle network. The HERMES component contains communication modules supporting 3G and 4G networks, and can be configured with short-range wireless networks (Wi-Fi or Bluetooth) for the infotainment system. The vulnerability received a CVSS v3.1 base score of 4.6 (Medium) with the vector string CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability allows attackers with physical access to the device hardware to obtain system information. The impact is primarily focused on information disclosure, with no direct impact on system integrity or availability (Threatpost).

Exploitation requires physical access to the device hardware. Researchers found that by physically accessing the system, they could tamper with the file system by adding an interactive shell with root privileges, allowing access to the TCU system's debugging functionality (Threatpost).

Mercedes-Benz took immediate incident response steps after learning of the vulnerabilities, including selectively blocking services and providing immediate fixes. The company also launched forensic investigations and deployed long-term fixes (Threatpost).

Guy Harpak, head of Product Security for Mercedes-Benz R&D, acknowledged the findings and stated that this case demonstrates how a strong research community working with industry can improve security (Threatpost).