CVE-2024-6032CWE-78

Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability

High · published April 30, 2025

CVSS v3.0
7.8
EPSS
1%
Percentile
44.2
In the wild
Unconfirmed
What it is

Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code on the target system in order to exploit this vulnerability.

The specific flaw exists within the ql_atfwd process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code on the target modem in the context of root. Was ZDI-CAN-23201.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00534 · 44.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-04-30T20:00Z
EPSS history
Timeline
  • 30 APR 20:00Z
    Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability
    cvelistv5