Researchers Demonstrate Zero-Click RCE on Tesla Model 3 via TPMS Sensors

Summary

Researchers demonstrated remote code execution on the Tesla Model 3’s VCC through a TPMS enrollment certificate overflow. The exploit enabled arbitrary CAN messages; Tesla released updated firmware with additional checks.

Key points

• Researchers found an integer overflow in the certificate-chunk start-index check during TPMS enrollment, enabling an out-of-bounds write in the VCC.
• The write could overwrite a function pointer and redirect execution to attacker-controlled code; certificate signature validation occurred afterward.
• The exploit used two ESP32 devices to interfere with a sensor connection and simulate a TPMS sensor during the vehicle’s auto-learn process.
• As proof of exploitation, the researchers sent arbitrary messages on the vehicle CAN bus. They said VCC code execution could enable actions such as opening the car and starting it.
• The vulnerability affected VCC firmware config ID24, released for recent Model 3 vehicles from October 2023; the researchers confirmed it on production hardware.
• Tesla provided hardware for testing and quickly released a new firmware version with additional checks.

Vendors