PT-2020-17162 · Tesla · Tesla Model X

Lennert Wouters · Published 2020-11-30 · Updated 2020-12-04 · CVE-2020-29439

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tesla Model X vehicles before 2020-11-23

Description The key fobs of the affected vehicles rely on five VIN digits for authentication to initiate a Bluetooth wake-up action through the body control module (BCM). The full VIN is visible from outside the vehicle.

Recommendations For Tesla Model X vehicles before 2020-11-23, consider restricting access to the vehicle's Bluetooth functionality until a fix is applied, as the key fobs' reliance on partial VIN digits for authentication poses a security risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2020-29439

Affected Products

Tesla Model X

References · 4

• 🔥 https://wired.com/story/tesla-model-x-hack-bluetooth · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-29439 · Security Note
• https://osv.dev/vulnerability/CVE-2020-29439 · Vendor Advisory
• https://t.me/cibsecurity/16959 · Telegram Post