CVE-2019-19562: 
NixOS vulnerability analysis and mitigation

An authentication bypass vulnerability (CVE-2019-19562) was discovered in the debug interface of Mercedes-Benz HERMES 2.1. The vulnerability allows attackers with physical access to device hardware to obtain system information. This vulnerability was disclosed on November 16, 2020 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.6 (MEDIUM) with the vector string CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The attack requires physical access to the device hardware, requires no privileges, and needs no user interaction. The vulnerability is classified under CWE-287 (Improper Authentication) (NVD).

When exploited, the vulnerability allows unauthorized access to system information through the debug interface. The impact is limited to confidentiality breach, with no direct impact on system integrity or availability (NVD).

The vulnerability requires physical access to the device hardware to be exploited. While the attack complexity is considered low, the requirement for physical access significantly limits the potential attack surface (NVD).

Mercedes-Benz has worked with the 360 Group's Cyber Security Brain to address this vulnerability. The collaboration aimed to strengthen car IT security across the industry (Threatpost).