Tesla Model S Iris Modem Command Injection Code Execution Vulnerability

A command injection vulnerability allowing local code execution has been identified in the Iris Modem of Tesla Model S vehicles. The issue arises in the ql_atfwd process, where user-supplied strings are not properly validated before being used in system calls. This lack of validation enables attackers with existing code execution capabilities on the system to execute arbitrary code on the modem with root privileges.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected vehicle's modem, with root privileges.

Remediation

This vulnerability has been fixed in Tesla Firmware Version 2024.8.