Tesla · Tesla Model 3 · CVE-2022-37709
**Name of the Vulnerable Software and Affected Versions**
Tesla Model 3 version V11.0(2022.4.5.1 6b701552d7a6)
Tesla mobile app version v4.23
**Description**
The issue allows attackers to bypass authentication by spoofing, specifically targeting the Phone Key authentication in the Tesla Model 3. This is vulnerable to Man-in-the-middle attacks in the BLE channel, enabling attackers to gain unauthorized access to open the door and drive the car away by leveraging access to a legitimate Phone Key.
**Recommendations**
For Tesla Model 3 version V11.0(2022.4.5.1 6b701552d7a6), consider disabling the Phone Key authentication feature until a patch is available.
For Tesla mobile app version v4.23, restrict access to the BLE channel to minimize the risk of exploitation.