Vulnerability · Published Sep 4, 2025 · Assigned by ASRG

CVE-2025-6785Tesla Model 3 Physical CAN Bus Injection

Medium 4.7

In plain English

A medium-severity injection in Model 3 from Tesla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 4.0)4.7Medium

Exploit odds (30 days)0.2%top 87.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Securing externally available CAN wires can easily allow physical access to the CAN bus, allowing possible injection of specially formed CAN messages to control remote start functions of the vehicle. Testing completed on Tesla Model 3 vehicles with software version v11.1 (2023.20.9 ee6de92ddac5). This issue affects Model 3: With software versions from 2023.Xx before 2023.44.

Affected products (as reported)

Vendor	Product	Versions
Tesla	Model 3	2023.xx – before 2023.44

Weakness: CWE-74, CWE-1263 · Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:D/RE:L/U:Amber

References

https://asrg.io/security-advisories/cve-2025-6785/ third-party-advisory