CVE-2025-6785 - CVE House
Back to Database
Status published Medium CVE-2025-6785

Tesla Model 3 Physical CAN Bus Injection

Vulnerability Description

Securing externally available CAN wires can easily allow physical access to the CAN bus, allowing possible injection of specially formed CAN messages to control remote start functions of the vehicle.  Testing completed on Tesla Model 3 vehicles with software version v11.1 (2023.20.9 ee6de92ddac5). This issue affects Model 3: With software versions from 2023.Xx before 2023.44.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-6785

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Netanel Saka (Plaxidityx)

References

More from Tesla

View All →
CVE-2025-8321
Tesla Wall Connector Firmware Downgrade Vulnerability
Medium 6.8
CVE-2025-8320
Tesla Wall Connector Content-Length Header Improper Input Validation Remote Code Execution Vulnerability
High 8.8
CVE-2025-34251
Tesla Telematics Control Unit (TCU) < v2025.14 Authentication Bypass
High 8.6
CVE-2025-2082
Tesla Model 3 VCSEC Integer Overflow Remote Code Execution Vulnerability
High 7.5
CVE-2024-6032
Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability
High 7.8

Affected Vendor

Affected Software

Model 3
Vulnerable Versions:
2023.xx

Timeline

Official Publish: September 4th, 2025
Last Modified: September 11th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-74 CWE-1263

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1562 Impair Defenses
Defense Evasion
T1213 Data from Information Repositories
Collection