CVE-2024-6031: fallo de gravedad alta en Tesla Model S
Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.8epss 0.2%
Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.
The specific flaw exists within the parsing of responses from AT commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23198.
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Tesla · Model SCVEs relacionadas — Tesla Model S
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-6032HIGHTesla Model S Iris Modem ql_atfwd Command Injection Code Execution VulnerabilityEPSS 0.5%CVE-2024-6029MEDIUMTesla Model S Iris Modem Race Condition Firewall Bypass VulnerabilityEPSS 0.2%CVE-2024-13943HIGHTesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape VulnerabilityEPSS 0.2%CVE-2024-6030HIGHTesla Model S oFono Unnecessary Privileges Sandbox Escape VulnerabilityEPSS 0.2%