PT-2025-40953 · Google+1 · Android Debug Bridge+1

Alex Plaskett + 1 · Published 2025-10-06 · Updated 2025-10-07 · CVE-2025-34251

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Tesla Telematics Control Unit (TCU) firmware versions prior to 2025.14

Description The Tesla Telematics Control Unit (TCU) firmware is susceptible to an authentication bypass. The TCU operates the Android Debug Bridge (adbd) with root privileges. Despite a security check intended to disable adb shell access, adb push/pull and adb forward functionalities remain accessible. An attacker with physical access can exploit this by writing an arbitrary file to a writable location and subsequently overwriting the kernel’s uevent helper or /proc/sys/kernel/hotplug entries through ADB. This allows for the execution of scripts with root privileges.

Recommendations Update Tesla Telematics Control Unit (TCU) firmware to version 2025.14 or later.

Exploit

Fix

Improper Privilege Management

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-269

CWE-288

Related Identifiers

CVE-2025-34251

Affected Products

Android Debug Bridge

Telematics Control Unit

References · 8

• 🔥 https://nccgroup.com/research-blog/technical-advisory-tesla-telematics-control-unit-adb-auth-bypass · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34251 · Security Note
• https://twitter.com/VulmonFeeds/status/1975358036995649771 · Twitter Post
• https://twitter.com/CVEnew/status/1975348014664298795 · Twitter Post
• https://t.me/CVEtracker/34285 · Telegram Post
• https://t.me/cveNotify/137591 · Telegram Post
• https://tesla.com · Note
• https://vulncheck.com/advisories/tesla-tcu-auth-bypass · Note