CVE-2022-3093 HIGH

CVE-2022-3093

Vendor Tesla

Product Model 3

Weakness CWE-367

Published March 29, 2023

Last update February 14, 2025

View on NVD All CVEs

CVSS base score

7.6/10

Attack vector Physical

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ice_updater update mechanism. The issue results from the lack of proper validation of user-supplied firmware. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17463.

Key dates

02Disclosure timeline

March 29, 2023 CVE published

February 14, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-3093 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/367.html

Related vulnerabilities

CVE-2022-3093

01Description

02Disclosure timeline

03References

04Related CVE