CVE-2025-6785CWE-1263CWE-74

Tesla Model 3 Physical CAN Bus Injection

Medium · published September 4, 2025

CVSS v4.0
4.7
EPSS
0%
Percentile
12.0
In the wild
Unconfirmed
What it is

Securing externally available CAN wires can easily allow physical access to the CAN bus, allowing possible injection of specially formed CAN messages to control remote start functions of the vehicle.  Testing completed on Tesla Model 3 vehicles with software version v11.1 (2023.20.9 ee6de92ddac5). This issue affects Model 3: With software versions from 2023.Xx before 2023.44.

The record
Technical detail
CVSS v4.0
4.7 · MEDIUM
Vector
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:D/RE:L/U:Amber
EPSS
0.00221 · 12.0th percentile
Weaknesses
CWE-1263 · Improper Physical Access Control; CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2025-09-04T14:13Z
EPSS history
Timeline
  • 04 SEP 14:13Z
    Tesla Model 3 Physical CAN Bus Injection
    cvelistv5