PT-2022-24044 · Tesla · Tesla Model 3+1

Jun Lu + 3 · Published 2022-09-16 · Updated 2025-03-24 · CVE-2022-37709

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tesla Model 3 version V11.0(2022.4.5.1 6b701552d7a6) Tesla mobile app version v4.23

Description The issue allows attackers to bypass authentication by spoofing, specifically targeting the Phone Key authentication in the Tesla Model 3. This is vulnerable to Man-in-the-middle attacks in the BLE channel, enabling attackers to gain unauthorized access to open the door and drive the car away by leveraging access to a legitimate Phone Key.

Recommendations For Tesla Model 3 version V11.0(2022.4.5.1 6b701552d7a6), consider disabling the Phone Key authentication feature until a patch is available. For Tesla mobile app version v4.23, restrict access to the BLE channel to minimize the risk of exploitation.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2022-37709

Affected Products

Tesla Model 3

Tesla Mobile App

References · 6

• 🔥 https://youtu.be/cPhYW5FzA9A · Exploit
• 🔥 https://fmsh-seclab.github.io · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-37709 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37709 · Vendor Advisory
• https://github.com/fmsh-seclab/TesMla · Note
• https://twitter.com/Tyler46409827/status/1904289968316682361 · Twitter Post