Details of the hack and disclosure set out nicely in this paper.
https://www.computest.nl/wp-content/...ar-rapport.pdf
Looks like this vulnerability effects all VAG MIB equipped cars built before week 22 of 2017.
(The VAG letter says week 22 of 2016, but given...