CVE-2020-29439 Auth bypass in n/a

Medium 4.6 Published 30 Nov 2020 Updated 4 Aug 2024

Attackers can bypass Bluetooth authentication on Tesla Model X vehicles by using visible VIN digits to wake the body control module.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-29439?

CVE-2020-29439 is a medium-severity authentication bypass vulnerability in n/a, published on 30 Nov 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Tesla Model X vehicles before 2020-11-23 have key fobs that rely on five VIN digits for the authentication needed for a body control module (BCM) to initiate a Bluetooth wake-up action. (The full VIN is visible from outside the vehicle.)

Which versions are affected by CVE-2020-29439?

It affects 1 product.

Products include Tesla Model X Firmware.

How do I fix CVE-2020-29439?

No fix has been published for CVE-2020-29439 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-29439 being exploited?

There is no known exploitation of CVE-2020-29439 in the wild and no public exploit code.

Sources

Also known as GHSA-6mr5-9ph2-p38v.