CVEvulnerability

CVE-2025-6785

4.7 MEDIUM Published 2025-09-04 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2025-09-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 4.0 ([email protected])
4.7 MEDIUM — CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:L/U:Amber
Weaknesses
CWE-1263, CWE-74

Description

Securing externally available CAN wires can easily allow physical access to the CAN bus, allowing possible injection of specially formed CAN messages to control remote start functions of the vehicle.  Testing completed on Tesla Model 3 vehicles with software version v11.1 (2023.20.9 ee6de92ddac5). This issue affects Model 3: With software versions from 2023.Xx before 2023.44.

Related

Weakness · CWE (2)

  • CWE-1263 Improper Physical Access Control weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References