ZDI-23-973: (Pwn2Own) Tesla Model 3 bsa_server BIP Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability
Published Jul 18, 2023
·Updated
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Tesla Model 3 vehicles. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.
Affected Software
1 affected component
Tesla Model 3
Event History
Jul 18, 2023
Advisory Published
05:00 AM
Data Sourced
05:00 AM
Description
Feb 24, 2025
Advisory Published
via ZDI·08:24 AM
Frequently Asked Questions
1
What is the severity of ZDI-23-973?
The severity of ZDI-23-973 is critical due to the potential for remote code execution.
2
How do I fix ZDI-23-973?
To fix ZDI-23-973, ensure that your Tesla Model 3 is updated with the latest software patch provided by Tesla.
3
Who is affected by ZDI-23-973?
ZDI-23-973 affects Tesla Model 3 vehicles that have not applied the necessary security updates.
4
What type of attack vector is used in ZDI-23-973?
ZDI-23-973 is exploited via a malicious Bluetooth device that pairs with the Tesla Model 3.
5
Can ZDI-23-973 be exploited remotely?
Yes, ZDI-23-973 can be exploited remotely provided the attacker has access to a malicious Bluetooth device.