Tesla Model 3 Physical CAN Bus Injection

published 2025-09-04 14 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-28895

cvss: 4.7; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits: 0; none known

Securing externally available CAN wires can easily allow physical access to the CAN bus, allowing possible injection of specially formed CAN messages to control remote start functions of the vehicle. Testing completed on Tesla Model 3 vehicles with software version v11.1 (2023.20.9 ee6de92ddac5). This issue affects Model 3: With software versions from 2023.Xx before 2023.44.

Patch / fix

fixed in 1

Tesla Model 3 2023.44

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 14 mo ago (2025-09-04)

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	4.7	CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:D/RE:L/U:Amber
CNA	4.0	4.7	CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:L/U:Amber

Affected products

Tesla Model 3

Classification

Weakness

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-1263 Improper Physical Access Control

References

asrg.io /security-advisories/cve-2025-6785/
third-party-advisory

Sources

CVE List CVE-2025-6785
NVD CVE-2025-6785

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary