Vulnerability · Published Apr 30, 2025 · Assigned by zdi

CVE-2024-6029Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability

Medium 5.0

In plain English

A medium-severity security flaw in Model S from Tesla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.0)5.0Medium

Exploit odds (30 days)0.2%top 87.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass the firewall on the Iris modem in affected Tesla Model S vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firewall service. The issue results from a failure to obtain the xtables lock. An attacker can leverage this vulnerability to bypass firewall rules. Was ZDI-CAN-23197.

Affected products (as reported)

Vendor	Product	Versions
Tesla	Model S	2023.44.29 with the AG525RGLAAR01A16M4G_OCPU_02.003.10.003 connectivity card

Weakness: CWE-367 · Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References

ZDI-25-260 x_research-advisory