CVE-2023-32156

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32156", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2023-05-03T20:10:47.061Z", "datePublished": "2024-05-03T01:56:38.929Z", "dateUpdated": "2024-09-18T18:28:21.387Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2024-09-18T18:28:21.387Z"}, "title": "Tesla Model 3 Gateway Firmware Signature Validation Bypass Vulnerability", "descriptions": [{"lang": "en", "value": "Tesla Model 3 Gateway Firmware Signature Validation Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Tesla Model 3 vehicles. An attacker must first obtain the ability to execute privileged code on the Tesla infotainment system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of firmware updates. The issue results from improper error-handling during the update process. An attacker can leverage this vulnerability to execute code in the context of Tesla's Gateway ECU.\n. Was ZDI-CAN-20734."}], "affected": [{"vendor": "Tesla", "product": "Model 3", "versions": [{"version": "Model 3 - 2023.6", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-367", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-972/", "name": "ZDI-23-972", "tags": ["x_research-advisory"]}], "dateAssigned": "2023-05-03T20:16:43.050Z", "datePublic": "2023-07-18T15:01:08.623Z", "source": {"lang": "en", "value": "David BERARD (@_p0ly_) and Vincent DEHORS (@vdehors) from Synacktiv (@Synacktiv)"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9, "baseSeverity": "CRITICAL"}}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32156", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-16T18:28:16.771162Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:tesla:model_3:-:*:*:*:*:*:*:*"], "vendor": "tesla", "product": "model_3", "versions": [{"status": "affected", "version": "-", "lessThan": "2023.12", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:26:30.613Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:10:24.017Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-972/", "name": "ZDI-23-972", "tags": ["x_research-advisory", "x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-972/", "name": "ZDI-23-972", "tags": ["x_research-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:10:24.017Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32156", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-16T18:28:16.771162Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:tesla:model_3:-:*:*:*:*:*:*:*"], "vendor": "tesla", "product": "model_3", "versions": [{"status": "affected", "version": "-", "lessThan": "2023.12", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-16T18:29:10.338Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Tesla Model 3 Gateway Firmware Signature Validation Bypass Vulnerability", "source": {"lang": "en", "value": "David BERARD (@_p0ly_) and Vincent DEHORS (@vdehors) from Synacktiv (@Synacktiv)"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 9, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}], "affected": [{"vendor": "Tesla", "product": "Model 3", "versions": [{"status": "affected", "version": "Model 3 - 2023.6"}], "defaultStatus": "unknown"}], "datePublic": "2023-07-18T15:01:08.623Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-972/", "name": "ZDI-23-972", "tags": ["x_research-advisory"]}], "dateAssigned": "2023-05-03T20:16:43.050Z", "descriptions": [{"lang": "en", "value": "Tesla Model 3 Gateway Firmware Signature Validation Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Tesla Model 3 vehicles. An attacker must first obtain the ability to execute privileged code on the Tesla infotainment system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of firmware updates. The issue results from improper error-handling during the update process. An attacker can leverage this vulnerability to execute code in the context of Tesla's Gateway ECU.\n. Was ZDI-CAN-20734."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2024-09-18T18:28:21.387Z"}}}, "cveMetadata": {"cveId": "CVE-2023-32156", "state": "PUBLISHED", "dateUpdated": "2024-09-18T18:28:21.387Z", "dateReserved": "2023-05-03T20:10:47.061Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2024-05-03T01:56:38.929Z", "assignerShortName": "zdi"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Model 3", "vendor": "Tesla", "versions": [{"status": "affected", "version": "Model 3 - 2023.6"}]}], "source": "zdi-disclosures@trendmicro.com"}, {"affectedData": [{"cpes": ["cpe:2.3:h:tesla:model_3:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "model_3", "vendor": "tesla", "versions": [{"lessThan": "2023.12", "status": "affected", "version": "-", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tesla:model_3_firmware:2023.6:*:*:*:*:*:*:*", "matchCriteriaId": "3D214E54-F9A5-4E96-BC85-C86DD869D122", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tesla:model_3:-:*:*:*:*:*:*:*", "matchCriteriaId": "825A79FD-C872-4564-9782-83BEEADDF5D9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tesla Model 3 Gateway Firmware Signature Validation Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Tesla Model 3 vehicles. An attacker must first obtain the ability to execute privileged code on the Tesla infotainment system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of firmware updates. The issue results from improper error-handling during the update process. An attacker can leverage this vulnerability to execute code in the context of Tesla's Gateway ECU.\n. Was ZDI-CAN-20734."}, {"lang": "es", "value": "Vulnerabilidad de omisi\u00f3n de validaci\u00f3n de firma de firmware de puerta de enlace Tesla Model 3. Esta vulnerabilidad permite a atacantes adyacentes a la red ejecutar c\u00f3digo arbitrario en los veh\u00edculos Tesla Model 3 afectados. Un atacante primero debe obtener la capacidad de ejecutar c\u00f3digo privilegiado en el sistema de informaci\u00f3n y entretenimiento de Tesla para poder explotar esta vulnerabilidad. La falla espec\u00edfica existe en el manejo de actualizaciones de firmware. El problema se debe a un manejo inadecuado de errores durante el proceso de actualizaci\u00f3n. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto de la ECU Gateway de Tesla. Era ZDI-CAN-20734."}], "id": "CVE-2023-32156", "lastModified": "2026-06-17T05:58:12.443", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-32156", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-05-16T18:28:16.771162Z", "version": "2.0.3"}}]}, "published": "2024-05-03T02:15:20.353", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-972/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-972/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}