TI-2025-24395 Aliases CVE-2025-34251 GHSA-jvpj-w5q8-mg28

Tesla Telematics Control Unit (TCU) < v2025.14 Authentication Bypass

LOW 38CWE-269Published 2025-10-06 · Updated 2026-05-15

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Privilege escalation, Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269 and CWE-288.

Summary

Tesla Telematics Control Unit (TCU) firmware prior to v2025.14 contains an authentication bypass vulnerability. The TCU runs the Android Debug Bridge (adbd) as root and, despite a “lockdown” check that disables adb shell, still permits adb push/pull and adb forward. Because adbd is privileged and the device’s USB port is exposed externally, an attacker with physical access can write an arbitrary file to a writable location and then overwrite the kernel’s uevent_helper or /proc/sys/kernel/hotplug entries via ADB, causing the script to be executed with root privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00446 39th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Telematics Control Unit (TCU) (Tesla): 2025.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Tesla	Telematics Control Unit (TCU)	before 2025.14	2025.14	Patch available	CNA

Telematics Control Unit (TCU) VendorTesla Affected before 2025.14 Fixed in 2025.14 Patch available CNA

Remediation

Fix · CNA Telematics Control Unit (TCU) (Tesla) Fixed in 2025.14

Timeline

2026-10-02 Threatist record created from CVE-2025-34251
2026-10-03 Alias added: GHSA-jvpj-w5q8-mg28

References

Exploit 1

https://www.nccgroup.com/research-blog/technical-advisory-tesla-telematics-control-unit-adb-auth-bypass/

Other 1

https://www.tesla.com/

TI-2019-07342 The renderer process in the entertainment system on Tesla Model 3 vehicles mishandles JIT… CVSS 3.0HIGH 8.8
TI-2025-07616 Tesla Wall Connector Content-Length Header Improper Input Validation Remote Code… CVSS 3.0HIGH 8.8
TI-2023-15459 Time-of-check time-of-use race condition in Tesla Model 3 CVSS 3.1HIGH 8.8
TI-2020-07441 Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded… CVSS 3.1HIGH 8.8
TI-2024-05590 OS command injection in Tesla Model S CVSS 3.0HIGH 7.8
TI-2022-20636 Buffer overflow in Tesla Model 3 CVSS 3.1HIGH 7.8

See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences