PWN MY RIDE: EXPLORING THE CARPLAY ATTACK SURFACE

Summary from the TLDR InfoSec newsletter

Oligo exposes Apple CarPlay's security vulnerabilities, focusing on CVE-2025-24132, a stack buffer overflow in the AirPlay protocol that enables remote code execution with root privileges. They detail how wireless CarPlay exposes vehicles to attacks, mainly because most cars rely on weak Bluetooth pairing. Attackers can exploit poor authentication to extract WiFi credentials and launch RCE attacks. Although Apple patched this in the AirPlay SDK, most car manufacturers haven't implemented these fixes, leaving many vehicles exposed.