var-201702-0923
Vulnerability from variot
An issue was discovered in Tesla Motors Model S automobile, all firmware versions before version 7.1 (2.36.31) with web browser functionality enabled. The vehicle's Gateway ECU is susceptible to commands that may allow an attacker to install malicious software allowing the attacker to send messages to the vehicle's CAN bus, a Command Injection. Tesla Gateway ECU is prone to a command-injection vulnerability. An attacker may leverage this issue to inject arbitrary commands. Versions prior to Tesla Gateway ECU 7.1 (2.36.31) are vulnerable. Tesla Motors Gateway ECU is a set of firmware used by Tesla Motors (Tesla) in the United States to manage cars and provide driving functions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201702-0923",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "gateway ecu",
"scope": "eq",
"trust": 1.6,
"vendor": "tesla",
"version": null
},
{
"model": "gateway ecu",
"scope": "lt",
"trust": 0.8,
"vendor": "tesla",
"version": "7.1 (2.36.31) (model s)"
},
{
"model": "gateway ecu",
"scope": "eq",
"trust": 0.3,
"vendor": "tesla",
"version": "0"
},
{
"model": "gateway ecu",
"scope": "ne",
"trust": 0.3,
"vendor": "tesla",
"version": "7.1(2.36.31)"
}
],
"sources": [
{
"db": "BID",
"id": "94697"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007985"
},
{
"db": "CNNVD",
"id": "CNNVD-201612-181"
},
{
"db": "NVD",
"id": "CVE-2016-9337"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:tesla:gateway_ecu",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-007985"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Tencent???s Keen Security Lab",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201612-181"
}
],
"trust": 0.6
},
"cve": "CVE-2016-9337",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 4.9,
"id": "CVE-2016-9337",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 4.9,
"id": "VHN-98157",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:H/AU:N/C:N/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 1.6,
"id": "CVE-2016-9337",
"impactScore": 5.2,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-9337",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2016-9337",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201612-181",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-98157",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-98157"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007985"
},
{
"db": "CNNVD",
"id": "CNNVD-201612-181"
},
{
"db": "NVD",
"id": "CVE-2016-9337"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in Tesla Motors Model S automobile, all firmware versions before version 7.1 (2.36.31) with web browser functionality enabled. The vehicle\u0027s Gateway ECU is susceptible to commands that may allow an attacker to install malicious software allowing the attacker to send messages to the vehicle\u0027s CAN bus, a Command Injection. Tesla Gateway ECU is prone to a command-injection vulnerability. \nAn attacker may leverage this issue to inject arbitrary commands. \nVersions prior to Tesla Gateway ECU 7.1 (2.36.31) are vulnerable. Tesla Motors Gateway ECU is a set of firmware used by Tesla Motors (Tesla) in the United States to manage cars and provide driving functions",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-9337"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007985"
},
{
"db": "BID",
"id": "94697"
},
{
"db": "VULHUB",
"id": "VHN-98157"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "ICS CERT",
"id": "ICSA-16-341-01",
"trust": 2.8
},
{
"db": "NVD",
"id": "CVE-2016-9337",
"trust": 2.8
},
{
"db": "BID",
"id": "94697",
"trust": 2.0
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007985",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201612-181",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-98157",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-98157"
},
{
"db": "BID",
"id": "94697"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007985"
},
{
"db": "CNNVD",
"id": "CNNVD-201612-181"
},
{
"db": "NVD",
"id": "CVE-2016-9337"
}
]
},
"id": "VAR-201702-0923",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-98157"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T22:26:52.293000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.tesla.com/"
},
{
"title": "Tesla Motors Gateway ECU Fixes for command injection vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=66222"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-007985"
},
{
"db": "CNNVD",
"id": "CNNVD-201612-181"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-77",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-98157"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007985"
},
{
"db": "NVD",
"id": "CVE-2016-9337"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-16-341-01"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/94697"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-9337"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-9337"
},
{
"trust": 0.3,
"url": "https://www.tesla.com/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-98157"
},
{
"db": "BID",
"id": "94697"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007985"
},
{
"db": "CNNVD",
"id": "CNNVD-201612-181"
},
{
"db": "NVD",
"id": "CVE-2016-9337"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-98157"
},
{
"db": "BID",
"id": "94697"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-007985"
},
{
"db": "CNNVD",
"id": "CNNVD-201612-181"
},
{
"db": "NVD",
"id": "CVE-2016-9337"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-02-13T00:00:00",
"db": "VULHUB",
"id": "VHN-98157"
},
{
"date": "2016-12-06T00:00:00",
"db": "BID",
"id": "94697"
},
{
"date": "2017-04-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-007985"
},
{
"date": "2016-12-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201612-181"
},
{
"date": "2017-02-13T21:59:01.610000",
"db": "NVD",
"id": "CVE-2016-9337"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-03-14T00:00:00",
"db": "VULHUB",
"id": "VHN-98157"
},
{
"date": "2016-12-20T01:08:00",
"db": "BID",
"id": "94697"
},
{
"date": "2017-04-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-007985"
},
{
"date": "2016-12-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201612-181"
},
{
"date": "2024-11-21T03:00:58.963000",
"db": "NVD",
"id": "CVE-2016-9337"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201612-181"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Tesla Model S Gateway ECU Command injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-007985"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "code injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201612-181"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…