Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-3093

This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ice_updater update mechanism. The issue results from the lack of proper validation of user-supplied firmware. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17463.

Published

2023-03-29T19:15:17.013

Last Modified

2024-11-21T07:18:48.747

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.4 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-367
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System tesla model_3_firmware < 2022.16.0.3 Yes
Hardware tesla model_3 - No
Operating System tesla model_s_firmware < 2022.16.0.3 Yes
Hardware tesla model_s - No
Operating System tesla model_x_firmware < 2022.16.0.3 Yes
Hardware tesla model_x - No
Operating System tesla model_y_firmware < 2022.16.0.3 Yes
Hardware tesla model_y - No
References