CVE-2023-32156 Tesla Model 3 Gateway Firmware Signature Validation Bypass Vulnerability

What is CVE-2023-32156?

CVE-2023-32156 is a critical vulnerability in Tesla Model 3, published on 3 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Tesla Model 3 Gateway Firmware Signature Validation Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Tesla Model 3 vehicles. An attacker must first obtain the ability to execute privileged code on the Tesla infotainment system in order to exploit this vulnerability.

The specific flaw exists within the handling of firmware updates. The issue results from improper error-handling during the update process. An attacker can leverage this vulnerability to execute code in the context of Tesla's Gateway ECU. . Was ZDI-CAN-20734.

Weakness: CWE-367

Which versions are affected by CVE-2023-32156?

It affects 1 product.

Products include Tesla Model 3 Firmware.

How do I fix CVE-2023-32156?

No fix has been published for CVE-2023-32156 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-32156 being exploited?

There is no known exploitation of CVE-2023-32156 in the wild and no public exploit code.

Other vulnerabilities in Tesla Model 3

• CVE-2022-42430 Use after free in Model 3 High 8.8
• CVE-2022-42431 Memory corruption in Model 3 High 8.8
• CVE-2019-9977 Code injection in n/a High 8.8
• CVE-2023-32155 Tesla Model 3 bcmdhd Out-Of-Bounds Write Local Privilege Escalation Vulnerability High 7.8
• CVE-2022-3093 Code injection in Model 3 High 7.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v757-7wm5-j6j9.