PT-2026-32137 · Go · Github.Com/Teslamotors/Fleet-Telemetry

Publicado 2026-04-01 · Atualizado 2026-04-01

OSV

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

A vulnerability in vehicle authentication allows threat actor with valid client credentials (i.e., a private key and certificate from a rooted infotainment system) to impersonate arbitrary VINs when authenticating to the telemetry server.

Impact

The attacker would be able to submit falsified telemetry records for arbitrary VINs.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

GHSA-PRXJ-3GCV-CQRH

Produtos afetados

Github.Com/Teslamotors/Fleet-Telemetry

Referências · 4

• https://github.com/teslamotors/fleet-telemetry · Nota
• https://github.com/teslamotors/fleet-telemetry/commit/d5ca0dab55812029fd38eb77f079f74ce4f47286 · Nota
• https://github.com/teslamotors/fleet-telemetry/security/advisories/GHSA-prxj-3gcv-cqrh · Nota
• https://osv.dev/vulnerability/GHSA-prxj-3gcv-cqrh · Aviso do Fabricante