PerfektBlue is a four-CVE Bluetooth exploit chain that can enable remote code execution on selected vehicle infotainment systems. PCA Cyber Security demonstrated the attack against Volkswagen, Škoda, and Mercedes infotainment hardware, and later reported BMW confirmations. The practical threat is nearby Bluetooth compromise of the head unit—not an internet-wide takeover of every car.
OpenSynergy says BlueSDK has been deployed in more than 400 million automotive shipments, which explains the concern about millions of potentially affected products. It does not prove that 400 million vehicles are vulnerable or unpatched. Owners should verify their infotainment firmware with the manufacturer or dealer and temporarily disable Bluetooth if an update is unavailable.
As an Amazon Associate I earn from qualifying purchases.
PerfektBlue is a four-vulnerability attack chain in OpenSynergy’s BlueSDK Bluetooth stack. On selected automotive infotainment systems, PCA Cyber Security demonstrated remote code execution over Bluetooth after the attacker satisfied the target’s pairing and authorization conditions. A successful compromise could expose the infotainment system, location data, phone information, and possibly provide a starting point for further vehicle-network attacks.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The risk is serious, but the headline needs precision. OpenSynergy says Blue SDK has appeared in more than 400 million automotive shipments and more than 1 billion end devices. Those figures show the scale of the software’s deployment—not the number of cars that are confirmed vulnerable, unpatched, or exploitable under identical conditions. There is no complete public model-by-model or VIN-level affected-vehicle list.
#1 Best Overall
- 2 Stage Shock Sensor
- Door, Bonnet & Boot Protection
- Engine Immobilization
- Parking Light Flash (Arm, Disarm & Trigger)
- Keyless Entry
PerfektBlue at a glance
| Question | Answer |
|---|---|
| What is it? | An exploit chain combining CVE-2024-45431, CVE-2024-45432, CVE-2024-45433, and CVE-2024-45434. |
| What does it target? | The embedded BlueSDK Bluetooth implementation, including Bluetooth components in some vehicle infotainment systems. |
| Is it an internet attack? | Not in the usual sense. The tested paths used a nearby Bluetooth connection and required pairing on the demonstrated devices. |
| What can it achieve? | Remote code execution in the Bluetooth application on selected systems, generally with that application’s permissions. |
| Are millions of cars confirmed vulnerable? | No. The deployment figures are broad product-family figures, not a verified count of affected vehicles. |
| Has a patch been created? | OpenSynergy told PCA that patches were rolled out in September 2024, but whether a particular vehicle received the fix depends on its OEM, supplier, firmware, and update channel. |
How the PerfektBlue attack works
PerfektBlue does not begin by remotely dialing a car’s cellular modem or logging into an internet-facing vehicle account. It attacks Bluetooth services implemented by the infotainment system. PCA’s public advisory describes the tested attack paths as accessible after pairing, although the exact requirement varies with the product’s Bluetooth security configuration.
That distinction matters. Some systems may require the driver to approve a pairing request. Others may use a profile or a Bluetooth configuration such as Just Works, which can change how much interaction is required. The public research does not establish one universal procedure for every BlueSDK integration.
- Bluetooth connection: The attacker must be close enough to communicate over the target’s Bluetooth radio and must meet the system’s connection and pairing requirements.
- Protocol abuse: The exploit chain sends malformed or unexpected data through Bluetooth protocol components, including L2CAP, RFCOMM, and AVRCP.
- Memory or logic corruption: The individual flaws create invalid states, unexpected function behavior, or memory-safety problems. Together, they provide a more useful attack path than the severity of some individual CVEs suggests.
- Code execution: PCA demonstrated execution of attacker-controlled code on selected infotainment targets. On a Volkswagen ID.4 demonstration, the researchers obtained a reverse shell with the permissions of the IVI Bluetooth application.
- Post-compromise activity: An attacker may then be able to interact with infotainment data and services available to that process. Further access depends on the operating system, privileges, network architecture, permissions, and the specific vehicle integration.
In plain English, remote means over the air from a nearby Bluetooth attacker—not automatically from anywhere on the internet. It also does not mean that every car parked nearby can be taken over without interaction. The demonstrated systems required pairing, and the exposure of other products depends on how each automaker and supplier configured BlueSDK.
The four CVEs behind the chain
The chain is called PerfektBlue because the practical result comes from combining several weaknesses. A CVSS score for one vulnerability should not be treated as a complete prediction of what the chain can do.
| CVE | Component or weakness | Why it matters |
|---|---|---|
| CVE-2024-45431 | Improper validation of the remote L2CAP channel identifier. | NVD records that BlueSDK through version 6.x can allow creation of an L2CAP channel with a null remote CID. L2CAP is a lower-level Bluetooth protocol used to transport and manage data channels. |
| CVE-2024-45432 | Incorrect function argument handling. | An incorrect variable can be used as a function argument, producing unexpected behavior and potentially exposing sensitive information. |
| CVE-2024-45433 | Incorrect function termination in the RFCOMM component. | RFCOMM provides serial-style communication over Bluetooth. PCA’s advisory describes a termination flaw that contributes to the exploit chain. |
| CVE-2024-45434 | Use-after-free in the AVRCP service. | AVRCP handles media-control functions such as play, pause, and track commands. NVD describes possible remote code execution in the context of the account running the Bluetooth process. Its CISA-enriched CVSS 3.1 score is 9.8. |
The last CVE has the highest individual severity rating, but the chain is the important point. PCA combined memory-corruption and logic flaws to obtain code execution on selected BlueSDK-based devices. A low- or medium-rated CVE should not be dismissed simply because it does not describe the complete exploit by itself.
Rank #2
- TYPE - 1-Way System
Which cars and infotainment systems were demonstrated?
PCA publicly demonstrated PerfektBlue on several infotainment platforms. These examples establish real affected integrations, but they are not a complete vehicle list.
| Manufacturer or group | Publicly described system or evidence | What the evidence does—and does not—show |
|---|---|---|
| Volkswagen | ID.4 using the MEB ICAS3 infotainment system. PCA demonstrated firmware versions 0561 and 0792. | The demonstration produced a reverse shell in the IVI Bluetooth application. It does not prove that every ID.4, every market, or every firmware release has the same exposure. |
| Škoda | Škoda Superb 3 using the Volkswagen Group MIB3 system, supplied by Preh Car Connect. | This confirms an affected MIB3-based integration, not every vehicle using the MIB3 name. |
| Mercedes-Benz | NTG6 infotainment hardware. PCA’s advisory also identifies NTG6 and NTG7 as examples of Mercedes systems that may be relevant. | There is no complete public Mercedes model-by-model affected list in the disclosure. |
| BMW | PCA’s timeline says it confirmed PerfektBlue on multiple BMW vehicles on June 6, 2025. The timeline was later updated with a BMW address-leak proof of concept on November 11, 2025. | Do not infer that every BMW model or head unit is affected. A current BMW-specific source is needed for a model and firmware determination. |
| Undisclosed OEM | PCA said it confirmed PerfektBlue on another OEM’s products but withheld the manufacturer’s name pending remediation. | The existence of another affected OEM was publicly described, but the products cannot be identified from the available disclosure. |
Vehicle manufacturers can use different head units, suppliers, regional firmware, Bluetooth security settings, and update processes under the same model name. A vehicle’s brand, model year, or ability to connect to a phone is therefore not enough to determine exposure.
What could an attacker do after compromising the infotainment system?
PCA describes several possible consequences of code execution on an IVI device:
- Track GPS coordinates available to the infotainment system.
- Record audio inside the vehicle if the compromised environment can access the relevant microphone functions.
- Obtain phonebook information and other data exposed through the paired phone or IVI software.
- Manipulate the infotainment interface, media, communications, or other functions controlled by the compromised application.
- Attempt privilege escalation to gain broader access on the head unit.
- Attempt lateral movement toward other electronic control units or vehicle networks.
These are potential capabilities and post-compromise paths, not a claim that every vulnerable car exposes every listed function. They also do not mean PerfektBlue has been shown to remotely steer, brake, unlock, or start every affected vehicle.
PCA distinguishes its IVI code-execution demonstrations from separate research involving movement from infotainment systems toward critical vehicle functions. Whether a particular vehicle’s infotainment system can communicate with safety-critical controllers depends on its network segmentation, gateways, permissions, and implementation. The confirmed risk is a serious infotainment and privacy compromise, with possible consequences beyond the head unit—not universal remote control of a car’s driving functions.
Rank #3
- 【Universal design】This car alarm system could fit for most of DC 12V cars(except old petrol cars). The remote controller has a zinc alloy frame, all buttons have good resilience.
- 【Keyless entry】This antitheft alarm systems have all basic keyless entry functions, such as lock/unlock, car finding, trurnk release, light flash, power window(original close model required), etc.
- 【Antitheft alarm】There is a 110dB siren with 6 tons for this car alarm, Alarming could be triggered by shock sensor & microwave sensor alarm and side door opening. Silent car alarm model could aslo be set.
- 【Engine blocking】This car alarm contains an engine cut-off relay. In arm status, it can cut off engine power and make engine fail to start. In running, it can cut off power to come with Anti-hijacking function.
- 【Central door locking automation】Car door will auto-lock after driving, and unlock after key turned to ACC OFF, So it will very safe for children in car. this function could be set ON or OFF(factory default is ON).
Learn more, but do not confuse education with a fix
If you want technical background on Bluetooth, CAN networks, infotainment systems, and connected-vehicle attack surfaces, an educational car hacking book can provide useful context. It will not test your VIN, identify a vulnerable BlueSDK version, or patch your vehicle; owners should use the manufacturer or an authorized dealer for those tasks.
Recommended Free Tools
Why the phrase “millions of cars” needs qualification
OpenSynergy’s current product information describes Blue SDK as deployed in more than 400 million automotive shipments, more than 1 billion end devices, and more than 20 million automotive radios. Earlier OpenSynergy material cited more than 350 million cars and more than 1 billion embedded devices.
Those numbers make a broad exposure claim understandable, but they are not a vulnerability census. They may include products using different BlueSDK versions, products with different configurations, devices outside vehicles, and systems that have since received a patch or been retired. They also do not reveal how many units remain in service, how many use Bluetooth features in an exploitable configuration, or how many have received an OEM remediation.
The defensible conclusion is that PerfektBlue affects a widely deployed software supply chain and may put millions of connected products at risk. It is not defensible to say that millions of identified cars were remotely hacked, that every vehicle using BlueSDK is vulnerable, or that mass exploitation in the wild has been reported. The available public material does not establish exploitation in the wild as of August 12, 2026.
Disclosure and patch timeline
| Date | Event |
|---|---|
| May 17, 2024 | PCA first contacted OpenSynergy. |
| May 24, 2024 | PCA transferred its advisory to OpenSynergy. |
| June 12, 2024 | OpenSynergy confirmed receipt. |
| July 15, 2024 | OpenSynergy confirmed the vulnerabilities and said it was working on patches. |
| August 30, 2024 | CVE numbers were reserved. |
| September 2024 | OpenSynergy told PCA that patches had been rolled out. That did not mean every OEM or vehicle had received them. |
| June 6, 2025 | PCA’s timeline recorded confirmation on multiple BMW vehicles. PCA said BMW had not received the vulnerability notice and patch through its supply chain at the time of the initial disclosure. |
| July 7, 2025 | PCA published its public advisory. |
| September 2025 | The CVE records were published. They identify BlueSDK through version 6.x, with NVD’s CPE enrichment listing versions through 6.0.1 for the affected product configuration. |
| November 11, 2025 | PCA’s timeline was updated with a BMW address-leak proof of concept. |
| March 31, 2026 | OpenSynergy’s product page listed Blue SDK 7.5 as released. |
There is an important gap between a stack vendor producing a patch and an owner receiving a repaired vehicle. Automotive software can pass through the stack vendor, a Tier 1 supplier, the head-unit manufacturer, the vehicle OEM, a dealer campaign, and an over-the-air update system. PCA said that, as late as June 2025, not all OEMs had received the patch because of these long supply chains.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #4
- Up to 1/4 mile range
- Clone-Safe Code-Hopping
- 2 Auxiliary Outputs
- Bright Blue LED Status Indicator
Blue SDK 7.5 should not be treated as a universal vehicle fix. OpenSynergy’s product page establishes that the release exists, but it does not establish that every affected integration migrated to it or that installing that version automatically remediates each OEM’s firmware. Only the vehicle manufacturer or supplier can confirm the remediation for a specific product.
What vehicle owners should do
- Install every available infotainment update. Check the vehicle’s official software-update screen, the manufacturer’s owner portal, or an authorized dealer. Do not install firmware from an unverified forum or random download.
- Check using your VIN. Contact the OEM or dealer with the vehicle identification number and the infotainment software version. Ask whether the head unit uses an affected BlueSDK release and whether the PerfektBlue remediation is included in the installed firmware.
- Record the exact software version. Menu names vary, but the relevant information is often under a path such as Settings, System, About, Software information, or Software update. Photograph or write down the version before contacting support.
- Disable Bluetooth temporarily if there is no update. PCA lists disabling Bluetooth as a mitigation when updating is not possible. This may remove hands-free calling, wireless audio, and other features, but it reduces exposure through the affected radio service. Ask the OEM whether Bluetooth can be disabled completely on your system.
- Reject unexpected pairing requests. Do not approve a pairing prompt you did not initiate, especially while parked in a public location or near unfamiliar devices. This is only a risk-reduction measure, not a substitute for a patch.
- Remove old pairings. Delete phones and devices that are no longer used. This limits unnecessary trusted relationships, although deleting pairings alone does not repair a vulnerable Bluetooth implementation.
- Review data after updating. Check saved contacts, call history, connected-device lists, microphone permissions, and infotainment accounts. An update may reset some settings or require devices to be paired again.
- Do not rely on accessories as a diagnosis. A generic OBD-II scanner, Bluetooth adapter, Faraday pouch, or signal blocker cannot prove whether the embedded BlueSDK implementation is vulnerable. PerfektBlue concerns vehicle firmware and the integrated Bluetooth stack, not every Bluetooth accessory connected to a car.
A useful question for the dealer or OEM
Ask: Does my VIN have an infotainment or head-unit update that remediates CVE-2024-45431, CVE-2024-45432, CVE-2024-45433, and CVE-2024-45434, and what exact software version should be installed? If the representative cannot answer, ask for escalation to the vehicle’s cybersecurity, technical-support, or software-update team. Do not assume that a routine map update or a phone-pairing reset includes the security patch.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What automakers and suppliers should learn from PerfektBlue
PerfektBlue is also a software-inventory and supply-chain problem. PCA said some OEMs were unaware that their products used BlueSDK or had not received the advisory and patch through the supply chain. A vendor component can be deeply embedded in a head unit while remaining invisible to the team responsible for the vehicle’s public security response.
Practical controls include:
- Maintain a software bill of materials: Track BlueSDK versions, components, configurations, suppliers, and the vehicle programs in which they are deployed.
- Assign component ownership: Define who receives vendor advisories, validates patches, creates the vehicle firmware, and communicates the final status to dealers and owners.
- Test the integrated product: A patched upstream library may require integration changes, configuration changes, regression testing, and validation on each head-unit variant.
- Make updates deliverable: Support secure over-the-air remediation where possible, with dealer procedures for vehicles that cannot update remotely.
- Review Bluetooth security settings: Pairing behavior, profile exposure, authentication requirements, privilege boundaries, and diagnostic access can materially change practical risk.
- Limit post-compromise reach: Segment infotainment networks, enforce gateway controls, use least privilege, and prevent a Bluetooth process from freely reaching safety-critical controllers.
- Improve disclosure coordination: Suppliers, Tier 1 vendors, OEMs, and researchers need a reliable route for distributing advisories and confirming that patches reached every affected program.
For OEMs and suppliers
A product owner that cannot map BlueSDK into its deployed head units should consider a vehicle security assessment or targeted vulnerability verification. PCA says it offers security assessment work and invites product owners to determine whether their products are affected. This is a B2B security-service consideration, not a consumer repair channel or a substitute for an OEM campaign.
Free tools Windows power users keep installed
One-click scans. No signup required.
What remains unknown
- There is no authoritative public list covering every affected vehicle model, market, head-unit supplier, BlueSDK version, and remediation status.
- The public disclosures do not establish how many vehicles remain unpatched as of August 12, 2026.
- They do not establish that every vehicle using BlueSDK is exposed under the same pairing conditions.
- They do not report confirmed mass exploitation of PerfektBlue in the wild.
- They do not demonstrate universal access to steering, braking, unlocking, starting, or other safety-critical functions.
Until OEM-specific advisories or VIN-level campaigns become available, owners should treat the issue as a reason to verify infotainment software—not as proof that a particular car is compromised.
Best Value
- WORK & SLEEP WITHOUT WORRY - CarLock anti theft car device and car alarm monitors and alerts you on your phone when your vehicle is moved, when the engine starts, if unusual vibration is detected & even if the device is disconnected!
- MONITOR YOUR TEENAGER - We love our teens but they can be entirely different people behind the wheel. Car Lock car safety device detects harsh acceleration (drag racing), hard breaking & sharp cornering (stunt driving).
- VIRTUAL MECHANIC - CarLock actively monitors the health of your vehicle and alerts you in advance if your car battery is running dangerously low or is experiencing high battery drain.
- LIKE GPS ON STEROIDS - Car Lock GPS tracker and car alarm includes detailed trip tracking which lets you monitor where your car has been. Whether your car is stolen or a "trusted" driver is going off course - you'll know!
- EXTREMELY AFFORDABLE - CarLock antitheft GPS vehicle tracker uses cloud computing, internet storage, GPS tracking and a modern day app (Android & iOS). You get all this for only $9.95 per month and the first month is FREE!
Source and scope note
This article reflects PCA Cyber Security’s public PerfektBlue advisory and disclosure timeline, OpenSynergy’s public Blue SDK deployment and product information, and the relevant NVD CVE records, including the CISA-enriched score for CVE-2024-45434. Public evidence is strongest for the demonstrated Volkswagen, Škoda, and Mercedes systems and more limited for additional OEMs. Software availability, vehicle campaigns, and affected configurations can change; an OEM or authorized dealer is the final authority for a specific vehicle.
Frequently Asked Questions
Can PerfektBlue hack a car from anywhere on the internet?
PerfektBlue is not described as an internet-wide, drive-by attack. The demonstrated paths used a nearby Bluetooth connection and required pairing on the tested systems. The exact exposure depends on each vehicle’s Bluetooth security configuration, including whether pairing requires user interaction.
Can an OBD-II scanner tell me whether my car is vulnerable?
No. A generic OBD-II scanner, Bluetooth adapter, Faraday pouch, or signal blocker cannot reliably identify a vulnerable BlueSDK version. Ask the vehicle manufacturer or authorized dealer to check the VIN and infotainment firmware, and ask whether the update includes fixes for all four PerfektBlue CVEs.
Does upgrading to Blue SDK 7.5 fix every affected car?
Not automatically. OpenSynergy lists Blue SDK 7.5 as released on March 31, 2026, but the public product information does not prove that every affected vehicle integration migrated to it. Only the OEM or supplier can confirm the firmware and remediation for a particular vehicle.
Which car models are affected by PerfektBlue?
PCA publicly demonstrated the chain on a Volkswagen ID.4 MEB ICAS3 system, a Škoda Superb 3 using MIB3, and Mercedes NTG6 hardware. PCA also reported confirmation on multiple BMW vehicles and one undisclosed OEM. There is no complete public model-by-model list, so brand and model year alone cannot establish exposure.
The Bottom Line
Bottom line: PerfektBlue is a credible, serious Bluetooth attack chain against selected BlueSDK-based infotainment systems, but “millions of cars” is a deployment-scale warning rather than a verified vulnerable-car count. Owners should install official infotainment updates, verify the result with the OEM using the VIN and software version, and disable Bluetooth temporarily if the manufacturer confirms that no update is available.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
