What’s Vulnerable › Vulnerabilities

CVE-2022-37709

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-16 · updated 2026-06-17
• Weakness: CWE-290

Description

Tesla Model 3 V11.0(2022.4.5.1 6b701552d7a6) Tesla mobile app v4.23 is vulnerable to Authentication Bypass by spoofing. Tesla Model 3's Phone Key authentication is vulnerable to Man-in-the-middle attacks in the BLE channel. It allows attackers to open a door and drive the car away by leveraging access to a legitimate Phone Key.

Affected products

• Tesla Model 3: 11.0
• Tesla: 4.23

References

• https://fmsh-seclab.github.io/
• https://github.com/fmsh-seclab/TesMla
• https://youtu.be/cPhYW5FzA9A
• https://fmsh-seclab.github.io/
• https://github.com/fmsh-seclab/TesMla
• https://youtu.be/cPhYW5FzA9A

Get alerted when CVE-2022-37709 or the next vulnerability affects your stack