PT-2017-10068 · Tesla Motors · Model S

Publicado 2017-02-13 · Atualizado 2017-03-14 · CVE-2016-9337

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tesla Motors Model S automobile versions prior to 7.1 (2.36.31)

Description An issue was discovered in the vehicle's Gateway ECU, which is susceptible to commands that may allow an attacker to install malicious software. This could enable the attacker to send messages to the vehicle's CAN bus, resulting in a Command Injection. The web browser functionality must be enabled for this issue to be present.

Recommendations For versions prior to 7.1 (2.36.31), consider disabling the web browser functionality as a temporary workaround until a patch is available. Restrict access to the vehicle's Gateway ECU to minimize the risk of exploitation. Avoid using the vehicle's web browser functionality in the affected firmware versions until the issue is resolved.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2016-9337

Produtos afetados

Model S

Referências · 3

• https://ics-cert.us-cert.gov/advisories/ICSA-16-341-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-9337 · Nota de Segurança
• http://securityfocus.com/bid/94697 · Nota