What’s Vulnerable › Vulnerabilities
CVE-2025-6785: Tesla Model 3 Physical CAN Bus Injection
- Severity: medium (CVSS 4.7 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-09-04 · updated 2026-06-17
- Weakness: CWE-74
Description
Securing externally available CAN wires can easily allow physical access to the CAN bus, allowing possible injection of specially formed CAN messages to control remote start functions of the vehicle. Testing completed on Tesla Model 3 vehicles with software version v11.1 (2023.20.9 ee6de92ddac5). This issue affects Model 3: With software versions from 2023.Xx before 2023.44.
Affected products
- Tesla Model 3: from 2023.xx before 2023.44 — fixed in 2023.44
How to fix
Upgrade to a fixed version: Tesla Model 3 2023.44. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-6785 or the next vulnerability affects your stack