CVE-2024-13943 Details
Description
Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape the sandbox on affected affected Tesla Model S vehicles. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the QCMAP_ConnectionManager component. An attacker can abuse the service to assign LAN addresses to the WWAN. An attacker can leverage this vulnerability to access network services that were only intended to be exposed to the internal LAN. Was ZDI-CAN-23199.
A sandbox escape vulnerability has been identified in the QCMAP_ConnectionManager component of the Tesla Model S Iris Modem. This vulnerability allows local attackers to escape the sandbox environment on affected vehicles. To exploit this vulnerability, an attacker must first gain the ability to execute low-privileged code on the target system. Once this is achieved, the vulnerability can be leveraged to assign LAN addresses to the WWAN, potentially allowing access to network services intended only for the internal LAN.
This vulnerability has been fixed in Tesla Firmware Version 2024.8.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 30, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-25-262/ | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tesla model s firmware | < 2024.8 |
CPE
Remediation
| |
| tesla model s | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 12, 2025 | Initial Analysis | [email protected] |
| Apr 30, 2025 | New CVE Received | [email protected] |