CVE-2024-6032

High

Description

Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code on the target system in order to exploit this vulnerability. The specific flaw exists within the ql_atfwd process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code on the target modem in the context of root. Was ZDI-CAN-23201.

SeverityHigh

CVSS7.8

Exploit probability—

ProductTesla Model S Firmware

PublishedApr 30, 2025

First seenApr 30, 2025

Weakness typeCWE-78OS command injection

How to fix

Update

tesla model_s_firmware2024.8 or later

Affected products

Product	Affected versions	Fixed in
tesla model_s_firmware	v < 2024.8	2024.8

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.