VULNERABILITY INTELLIGENCE
CVE-2025-6785
CVSS score4.7 MEDIUM
EPSS probability0.22%
CISA KEVNot currently listed
Published2025-09-04
Last modified2026-06-17
CVSS vectorCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:D/RE:L/U:Amber
Description
Securing externally available CAN wires can easily allow physical access to the CAN bus, allowing possible injection of specially formed CAN messages to control remote start functions of the vehicle. Testing completed on Tesla Model 3 vehicles with software version v11.1 (2023.20.9 ee6de92ddac5). This issue affects Model 3: With software versions from 2023.Xx before 2023.44.
Weakness classification
- CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-1263: Improper Physical Access Control