VULNERABILITY INTELLIGENCE

CVE-2016-9337

CVSS score6.8 MEDIUM

EPSS probability1.71%

CISA KEVNot currently listed

Published2017-02-13

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

Description

An issue was discovered in Tesla Motors Model S automobile, all firmware versions before version 7.1 (2.36.31) with web browser functionality enabled. The vehicle's Gateway ECU is susceptible to commands that may allow an attacker to install malicious software allowing the attacker to send messages to the vehicle's CAN bus, a Command Injection.

Weakness classification

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Primary references

ics-cert@hq.dhs.gov — Third Party Advisory, VDB Entry
ics-cert@hq.dhs.gov — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource