HIGH🇬🇧 English

CVE-2025-2082

CVSS 7.5v3.0pub. 2025-04-30upd. 2025-08-12

Tesla Model 3 VCSEC Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Tesla Model 3 vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the VCSEC module. By manipulating the certificate response sent from the Tire Pressure Monitoring System (TPMS), an attacker can trigger an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the VCSEC module and send arbitrary messages to the vehicle CAN bus. Was ZDI-CAN-23800.

oryginał EN
CVSS Vector
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Tesla Model 3

    HW
    Tesla
    wszystkie wersje

  • Tesla Model 3 Firmware

    OS
    Tesla
    < 2024.14
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
RCE
CWE
Referencje

Powiązane podatności

CVE-2023-32155HIGH7.0ten sam produkt

Tesla Model 3 bcmdhd Out-Of-Bounds Write Local Privilege Escalation Vulnerability. This vulnerability allows l...

CVE-2023-32157HIGH7.5ten sam produkt

Tesla Model 3 bsa_server BIP Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerabi...

CVE-2023-32156HIGH8.8ten sam produkt

Tesla Model 3 Gateway Firmware Signature Validation Bypass Vulnerability. This vulnerability allows network-ad...

CVE-2022-42430HIGH7.8ten sam produkt

This vulnerability allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must ...

CVE-2022-42431HIGH7.8ten sam produkt

This vulnerability allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must ...