Tesla Wall Connector Vulnerabilities
Overview
Two critical vulnerabilities affecting Tesla Wall Connector devices were disclosed by the Zero Day Initiative (ZDI) on July 30, 2025. These vulnerabilities allow attackers to execute arbitrary code on the charging stations, potentially leading to unauthorized control, data theft, or disruption of charging services.
Affected Products
- Tesla Wall Connector (Gen 3 & Gen 4) with firmware versions prior to 2025.24.1.
1. CVE-2025-8321: Firmware Downgrade Vulnerability
Description
This vulnerability allows physically present attackers to downgrade the firmware of a Tesla Wall Connector, bypassing security checks. A successful exploit could enable arbitrary code execution due to improper validation of firmware signatures during the downgrade process.
Attack Scenario
- Attacker Gains Physical Access: An attacker connects to the Wall Connector’s maintenance port (USB or serial interface).
- Firmware Downgrade Initiated: Using a modified firmware image, the attacker forces a downgrade to an older, vulnerable firmware version.
- Exploiting Older Vulnerabilities: The attacker leverages known exploits in the older firmware to gain root access.
- Arbitrary Code Execution: The attacker installs malicious software, modifies charging behavior, or exfiltrates sensitive data.
Mitigation
- Tesla has released a firmware update (2025.24.1) that enforces cryptographic signature verification for all firmware updates.
- Physical security measures (e.g., tamper-proof enclosures) should be implemented to prevent unauthorized access.
2. CVE-2025-8320: Content-Length Header Improper Input Validation RCE
Description
This remote code execution (RCE) vulnerability allows network-adjacent attackers (e.g., devices on the same Wi-Fi network) to execute arbitrary code by sending a malformed HTTP request with a manipulated Content-Length header.
Attack Scenario
- Attacker on the Same Network: The attacker scans for Tesla Wall Connectors on the local network.
- Crafting a Malicious Request: The attacker sends an HTTP POST request with an overly large
Content-Lengthvalue, triggering a buffer overflow. - Memory Corruption & Code Execution: The Wall Connector’s web server fails to validate input, leading to memory corruption and shell access.
- Lateral Movement: The attacker pivots to other connected devices (e.g., Tesla vehicles, home automation systems).
Mitigation
- Apply Tesla’s firmware patch (2025.24.1), which includes proper input validation.
- Segment home/charging networks to prevent lateral movement.
Conclusion
These vulnerabilities highlight the risks of IoT devices in critical infrastructure. Users should:
✔ Update firmware immediately to the latest version.
✔ Restrict physical and network access to charging stations.
✔ Monitor for unusual activity (e.g., unexpected reboots, charging interruptions).
Tesla has addressed these issues in their latest security bulletin. Stay vigilant and apply patches promptly to mitigate exploitation risks.