CVE-2025-6785
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-04

Last updated on: 2025-09-04

Assigner: Automotive Security Research Group (ASRG)

Description
Securing externally available CAN wires can easily allow physical access to the CAN bus, allowing possible injection of specially formed CAN messages to control remote start functions of the vehicle.  Testing completed on Tesla Model 3 vehicles with software version v11.1 (2023.20.9 ee6de92ddac5). This issue affects Model 3: With software versions from 2023.Xx before 2023.44.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-04
Last Modified
2025-09-04
Generated
2026-06-16
AI Q&A
2025-09-04
EPSS Evaluated
2026-06-14
NVD
CVE-2025-6785
EUVD
EUVD-2025-28895
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
tesla model_3 *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-1263 The product is designed with access restricted to certain information, but it does not sufficiently protect against an unauthorized actor with physical access to these areas.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves the ability to physically access the CAN bus through externally available CAN wires. An attacker with physical access can inject specially formed CAN messages to control remote start functions of the vehicle, specifically tested on Tesla Model 3 vehicles with certain software versions.

Impact Analysis

If exploited, this vulnerability could allow an attacker with physical access to the vehicle's CAN bus to remotely start the vehicle without authorization, potentially leading to unauthorized use or theft.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-6785. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart