Security researchers hacked Tesla's Wall Connector electric vehicle charger twice on the second day of the Pwn2Own Automotive 2025 hacking contest. They also exploited 23 more zero-day vulnerabilities in WOLFBOX, ChargePoint Home Flex, Autel MaxiCharger, Phoenix Contact CHARX, and EMPORIA EV chargers, as well as in the Alpine iLX-507, Kenwood DMX958XR, Sony XAV-AX8500 In-Vehicle Infotainment (IVI) systems. PHP Hooligans were the first to crash the Tesla Wall Connector after using a Numeric Range Comparison Without Minimum Check zero-day bug to take over the device. They were followed by Synacktiv, who also hacked Tesla's EV charger via the Charging Connector, an approach that's never been demonstrated publicly before. Today, two bug collisions occurred during Tesla Wall Connector hacking attempts: one by team PCAutomotive and the other by the Summoning Team's Sina Kheirkhah, who used an exploit chain of two already-known bugs. According to the Pwn2Own Tokyo 2025 contest rules, all devices targeted during the competition must have all security updates installed and run the latest operating system versions. Trend Micro's Zero Day Initiative awarded $335,500 in cash rewards during the second day for 23 zero-day vulnerabilities. Sina Kheirkhah is currently in the lead for Master of Pwn.
On the first day of Pwn2Own Automotive, security researchers exploited 16 unique zero-day vulnerabilities and collected $382,750 in cash awards. After the competition ends, vendors will have 9...