CVE-2022-23126

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login access to obtain a token for Tesla API calls.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/adriankumpf/teslamate/commit/fff6915e7364f83b3030f980d5743299c4e5260dPatch, Third Party Advisory
https://github.com/adriankumpf/teslamate/compare/v1.25.0...v1.25.1Patch, Third Party Advisory
https://github.com/adriankumpf/teslamate/releases/tag/v1.25.1Release Notes, Third Party Advisory
https://medium.com/%40david_colombo/how-i-got-access-to-25-teslas-around-the-world-by-accident-and-curiosity-8b9ef040a028
https://twitter.com/teslascope/status/1481252837174624258Issue Tracking, Third Party Advisory
https://github.com/adriankumpf/teslamate/commit/fff6915e7364f83b3030f980d5743299c4e5260dPatch, Third Party Advisory
https://github.com/adriankumpf/teslamate/compare/v1.25.0...v1.25.1Patch, Third Party Advisory
https://github.com/adriankumpf/teslamate/releases/tag/v1.25.1Release Notes, Third Party Advisory
https://medium.com/%40david_colombo/how-i-got-access-to-25-teslas-around-the-world-by-accident-and-curiosity-8b9ef040a028
https://twitter.com/teslascope/status/1481252837174624258Issue Tracking, Third Party Advisory

Timeline

Published: Jan 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-231276.1Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions CVE-2022-231289.8Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), CVE-2022-231295.5Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS GENESIS6 CVE-2022-23137.3A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and o CVE-2022-231305.5Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64 versions 10.97 and p CVE-2022-231319.8In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, beca CVE-2022-231327.3During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case CVE-2022-231335.4An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is CVE-2022-231345.3After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users a CVE-2022-231356.5There is a directory traversal vulnerability in some home gateway products of ZTE. Due to the lack of verification of user modified destinat CVE-2022-231365.4There is a stored XSS vulnerability in ZTE home gateway product. An attacker could modify the gateway name by inserting special characters a CVE-2022-231376.1ZTE's ZXCDN product has a reflective XSS vulnerability. The attacker could modify the parameters in the content clearing request url, and wh