CVE-2024-13943

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape the sandbox on affected affected Tesla Model S vehicles. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the QCMAP_ConnectionManager component. An attacker can abuse the service to assign LAN addresses to the WWAN. An attacker can leverage this vulnerability to access network services that were only intended to be exposed to the internal LAN. Was ZDI-CAN-23199.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Apr 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-139447.8Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Window CVE-2024-139456.0Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised. This CVE-2024-139466.8DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commi CVE-2024-139476.0Device commissioning parameters in ASPECT may be modified by an external source if administrative credentials become compromisedThis issue a CVE-2024-139487.3Windows permissions for ASPECT configuration toolsets are not fully secured allow-ing exposure of configuration informationThis issue affect CVE-2024-139496.8Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials becom CVE-2024-13956.7Use After Free vulnerability in Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU m CVE-2024-139506.8Log injection vulnerabilities in ASPECT provide attacker access to inject malicious browser scripts if administrator credentials become comp CVE-2024-139517.6One way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attackerThis issue affects ASPE CVE-2024-139528.4Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become CVE-2024-139534.9Sensitive device logger information in ASPECT may be exposed if administrator credentials become compromisedThis issue affects ASPECT-Enterp CVE-2024-139546.5Serialized configuration information may be disclosed during device commissioning while using ASPECT's configuration toolsetThis issue affec