CVE-2022-23126

Опубликовано: 24 янв. 2022

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login access to obtain a token for Tesla API calls.

Ссылки

https://github.com/adriankumpf/teslamate/commit/fff6915e7364f83b3030f980d5743299c4e5260d
Patch
Third Party Advisory
https://github.com/adriankumpf/teslamate/compare/v1.25.0...v1.25.1
Patch
Third Party Advisory
https://github.com/adriankumpf/teslamate/releases/tag/v1.25.1
Release Notes
Third Party Advisory
https://medium.com/%40david_colombo/how-i-got-access-to-25-teslas-around-the-world-by-accident-and-curiosity-8b9ef040a028
https://twitter.com/teslascope/status/1481252837174624258
Issue Tracking
Third Party Advisory
https://github.com/adriankumpf/teslamate/commit/fff6915e7364f83b3030f980d5743299c4e5260d
Patch
Third Party Advisory
https://github.com/adriankumpf/teslamate/compare/v1.25.0...v1.25.1
Patch
Third Party Advisory
https://github.com/adriankumpf/teslamate/releases/tag/v1.25.1
Release Notes
Third Party Advisory
https://medium.com/%40david_colombo/how-i-got-access-to-25-teslas-around-the-world-by-accident-and-curiosity-8b9ef040a028
https://twitter.com/teslascope/status/1481252837174624258
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:teslamate:teslamate:*:*:*:*:*:*:*:*

Версия до 1.25.1 (исключая)

EPSS

Процентиль: 77%

0.01027

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-287

Связанные уязвимости

GHSA-v336-j6w6-qhrr