CVE-2024-13943 Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability
Local attackers can escape the sandbox to access internal network services via improper input validation in the Iris Modem.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-13943?
CVE-2024-13943 is a high-severity vulnerability in Tesla Model S, published on 30 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape the sandbox on affected affected Tesla Model S vehicles. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the QCMAP_ConnectionManager component. An attacker can abuse the service to assign LAN addresses to the WWAN. An attacker can leverage this vulnerability to access network services that were only intended to be exposed to the internal LAN. Was ZDI-CAN-23199.
Weakness: CWE-20
Which versions are affected by CVE-2024-13943?
It affects 1 product.
Products include Tesla Model S Firmware.
How do I fix CVE-2024-13943?
No fix has been published for CVE-2024-13943 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-13943 being exploited?
There is no known exploitation of CVE-2024-13943 in the wild and no public exploit code.
Other vulnerabilities in Tesla Model S
- CVE-2024-6031 Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability
- CVE-2024-6032 Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability
- CVE-2024-6030 Tesla Model S oFono Unnecessary Privileges Sandbox Escape Vulnerability
- CVE-2024-6029 Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability
Sources
Also known as GHSA-2rm2-cf7c-m25m.