CVE-2024-6032: (Pwn2Own) Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability
Tesla Model S Iris Modem qlatfwd Command Injection Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code on the target system in order to exploit this vulnerability. The specific flaw exists within the qlatfwd process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code on the target modem in the context of root. Was ZDI-CAN-23201.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6032?
CVE-2024-6032 is classified as a high severity vulnerability due to its potential for arbitrary code execution.
What is CVE-2024-6032?
CVE-2024-6032 is a command injection vulnerability affecting the Tesla Model S Iris Modem that allows local attackers to execute arbitrary code.
How do I fix CVE-2024-6032?
To mitigate CVE-2024-6032, Tesla users should ensure their vehicles are running the latest firmware updates provided by Tesla.
Who is affected by CVE-2024-6032?
CVE-2024-6032 affects Tesla Model S vehicles that are running older versions of the Iris Modem firmware.
What can attackers do with CVE-2024-6032?
Attackers exploiting CVE-2024-6032 can execute arbitrary code, potentially leading to unauthorized control over the vehicle's systems.