CVE-2022-3093

EUVD-2022-42522
This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ice_updater update mechanism. The issue results from the lack of proper validation of user-supplied firmware. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17463.
TOCTOU
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.4 MEDIUM
PHYSICAL
HIGH
NONE
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
zdiCNA
7.6 HIGH
PHYSICAL
LOW
NONE
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 29%
Affected Products (NVD)
VendorProductVersion
teslamodel_3_firmware
𝑥
< 2022.16.0.3
teslamodel_s_firmware
𝑥
< 2022.16.0.3
teslamodel_x_firmware
𝑥
< 2022.16.0.3
teslamodel_y_firmware
𝑥
< 2022.16.0.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.zerodayinitiative.com/advisories/ZDI-22-1188/
https://www.zerodayinitiative.com/advisories/ZDI-22-1188/