The PerfektBlue Attack Scenario: Deconstructing a Four-Stage Automotive Bluetooth Exploit and Implementing Defensive Modifications
Year: 2026
Type: article
Abstract: The increasing complexity of In-Vehicle Infotainment (IVI) systems is characterized by smartphone integration via Bluetooth and has significantly expanded the automotive attack surface. Traditional automotive security models focused on CAN bus isolation, and are insufficient against remote, protocol-layer exploits targeting unauthenticated spheres. This paper presents a vast and detailed technical analysis of the "PerfektBlue” exploit chain, which is a sophisticated four-stage attack targeting automotive Bluetooth frameworks. Here is a minute examination of the operational flow, progressing from initial unauthenticated access via CWE-306, through the exploitation of critical logic flaws in the L2CAP layer (CVE-2024-45431), silent pairing bypasses (CVE-2024-45433), data exfiltration through high-privilege bridge interfaces (CVE-2024-45432), and terminal system paralysis via command injection (CVE-2024-45434). The findings reveal that the logic errors born from improper input validation are devastating as memory corruption, requiring robust domain isolation in safety-critical automotive software.
Authors: Vivek Agashe, Swati Deshmukh, Manisha Dudhedia
Institution: Marathwada Mitra Mandal's College of Engineering
Language: English
Subfield: Hardware and Architecture
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7165367488