CVE-2025-6785 Tesla Model 3 Physical CAN Bus Injection
Physical access to CAN bus allows message injection to control remote start functions in Tesla Model 3 vehicles.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-6785?
CVE-2025-6785 is a medium-severity vulnerability in Tesla Model 3, published on 4 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Securing externally available CAN wires can easily allow physical access to the CAN bus, allowing possible injection of specially formed CAN messages to control remote start functions of the vehicle. Testing completed on Tesla Model 3 vehicles with software version v11.1 (2023.20.9 ee6de92ddac5). This issue affects Model 3: With software versions from 2023.Xx before 2023.44.
Which versions are affected by CVE-2025-6785?
How do I fix CVE-2025-6785?
No fix has been published for CVE-2025-6785 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-6785 being exploited?
There is no known exploitation of CVE-2025-6785 in the wild and no public exploit code.
Sources
Also known as GHSA-wqqj-jmr5-3p39.