CVE-2022-3093

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-29 · updated 2026-06-17
Weakness: CWE-367

Description

This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ice_updater update mechanism. The issue results from the lack of proper validation of user-supplied firmware. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17463.

Affected products

Tesla Model 3: before 2022.16.0.3 — fixed in 2022.16.0.3
Tesla Model S: before 2022.16.0.3 — fixed in 2022.16.0.3
Tesla Model X Firmware: before 2022.16.0.3 — fixed in 2022.16.0.3
Tesla Model Y Firmware: before 2022.16.0.3 — fixed in 2022.16.0.3

How to fix

Upgrade to a fixed version: Tesla Model 3 2022.16.0.3; Tesla Model S 2022.16.0.3; Tesla Model X Firmware 2022.16.0.3; Tesla Model Y Firmware 2022.16.0.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-3093 or the next vulnerability affects your stack