CVE-2022-23126

EUVD-2022-28217
TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login access to obtain a token for Tesla API calls.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 77%
Affected Products (NVD)
VendorProductVersion
teslamateteslamate
𝑥
< 1.25.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/adriankumpf/teslamate/commit/fff6915e7364f83b3030f980d5743299c4e5260d
https://github.com/adriankumpf/teslamate/compare/v1.25.0...v1.25.1
https://github.com/adriankumpf/teslamate/releases/tag/v1.25.1
https://medium.com/%40david_colombo/how-i-got-access-to-25-teslas-around-the-world-by-accident-and-curiosity-8b9ef040a028
https://twitter.com/teslascope/status/1481252837174624258
https://github.com/adriankumpf/teslamate/commit/fff6915e7364f83b3030f980d5743299c4e5260d
https://github.com/adriankumpf/teslamate/compare/v1.25.0...v1.25.1
https://github.com/adriankumpf/teslamate/releases/tag/v1.25.1
https://medium.com/%40david_colombo/how-i-got-access-to-25-teslas-around-the-world-by-accident-and-curiosity-8b9ef040a028
https://twitter.com/teslascope/status/1481252837174624258