CVE-2020-29440

EUVD-2020-21813
Tesla Model X vehicles before 2020-11-23 do not perform certificate validation during an attempt to pair a new key fob with the body control module (BCM). This allows an attacker (who is inside a vehicle, or is otherwise able to send data over the CAN bus) to start and drive the vehicle with a spoofed key fob.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.6 MEDIUM
PHYSICAL
LOW
NONE
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 20%
Affected Products (NVD)
VendorProductVersion
teslamodel_x_firmware
𝑥
< 2020-11-23
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.wired.com/story/tesla-model-x-hack-bluetooth/
https://www.wired.com/story/tesla-model-x-hack-bluetooth/