Vulnerability · Published Oct 6, 2025 · Assigned by VulnCheck

CVE-2025-34251Tesla Telematics Control Unit (TCU) < v2025.14 Authentication Bypass

High 8.6

In plain English

A high-severity privilege mismanagement in Telematics Control Unit (TCU) from Tesla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.4%top 61.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tesla Telematics Control Unit (TCU) firmware prior to v2025.14 contains an authentication bypass vulnerability. The TCU runs the Android Debug Bridge (adbd) as root and, despite a “lockdown” check that disables adb shell, still permits adb push/pull and adb forward. Because adbd is privileged and the device’s USB port is exposed externally, an attacker with physical access can write an arbitrary file to a writable location and then overwrite the kernel’s uevent_helper or /proc/sys/kernel/hotplug entries via ADB, causing the script to be executed with root privileges.

Affected products (as reported)

Vendor	Product	Versions
Tesla	Telematics Control Unit (TCU)	0 – before 2025.14

Weakness: CWE-269, CWE-288 · Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://www.tesla.com/ product
https://www.nccgroup.com/research-blog/technical-advisory-tesla-telematics-control-unit-adb-auth-bypass/ technical-description, exploit
https://www.vulncheck.com/advisories/tesla-tcu-auth-bypass third-party-advisory