How severe is CVE-2020-16142?

CVE-2020-16142 has a CVSS 3.x base score of 3.5, rated low severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2020-16142 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-16142?

CVE-2020-16142 affects Mercedes-benz Comand. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-16142?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-16142 published?

CVE-2020-16142 was published on 2020-08-27 and last updated on 2026-06-17.

CVE-2020-16142

CVE-2020-16142 is a low-severity vulnerability in Mercedes-benz Comand with a CVSS 3.x base score of 3.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-134.

Key facts

Severity: Low (CVSS 3.x base score 3.5)
CVSS v2: 2.9
EPSS exploit prediction: 1% (51st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-134
Affected product: Mercedes-benz Comand
Published: 2020-08-27
Last modified: 2026-06-17

Description

On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a device name in the COMAND infotainment software.

Frequently asked questions

What is CVE-2020-16142?: On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a device name in the COMAND infotainment software.
How severe is CVE-2020-16142?: CVE-2020-16142 has a CVSS 3.x base score of 3.5, rated low severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2020-16142 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-16142?: CVE-2020-16142 affects Mercedes-benz Comand. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-16142?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-16142 published?: CVE-2020-16142 was published on 2020-08-27 and last updated on 2026-06-17.

References

https://medium.com/%40reliable_lait_mouse_975/mercedes-comand-infotainment-improper-format-strings-handling-4c67063d744e

Affected products (1)

cpe:2.3:o:mercedes-benz:comand:-:*:*:*:*:*:*:*

More vulnerabilities in Mercedes-benz Comand

CVE-2018-18070 — Medium (CVSS 5.9): An issue was discovered in Daimler Mercedes-Benz COMAND 17/13.0 50.12 on Mercedes-Benz C-Class 2018 vehicles. Defining…

All CVEs affecting Mercedes-benz Comand →

Other CWE-134 vulnerabilities

CVE-2012-1851 — Critical (CVSS 10.0): Format string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2,…
CVE-2012-0242 — Critical (CVSS 10.0): Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary…
CVE-2011-2475 — Critical (CVSS 10.0): Format string vulnerability in ECTrace.dll in the iMailGateway service in the Internet Mail Gateway in OneBridge Server…
CVE-2011-1568 — Critical (CVSS 10.0): Format string vulnerability in the logText function in shmemmgr9.dll in IGSSdataServer.exe 9.00.00.11074, and…
CVE-2010-4235 — Critical (CVSS 10.0): Format string vulnerability in RealNetworks Helix Server 12.x, 13.x, and 14.x before 14.2, and Helix Mobile Server…
CVE-2011-0270 — Critical (CVSS 10.0): Format string vulnerability in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows…

Browse all CWE-134 vulnerabilities →