CVE-2022-23126 - Vulnerability Details - OpenCVE

TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login access to obtain a token for Tesla API calls.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Teslamate	Teslamate

Configuration 1 [-]

cpe:2.3:a:teslamate:teslamate:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/adriankumpf/teslamate/commit/fff6915e7364f83b3030f980d5743299c4e5260d
https://github.com/adriankumpf/teslamate/compare/v1.25.0...v1.25.1
https://github.com/adriankumpf/teslamate/releases/tag/v1.25.1
https://medium.com/%40david_colombo/how-i-got-access-to-25-teslas-around-the-world-by-accident-and-curiosity-8b9ef040a028
https://twitter.com/teslascope/status/1481252837174624258

History

Wed, 28 May 2025 22:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Teslamate Teslamate teslamate
CPEs	cpe:2.3:a:teslamate_project:teslamate::::::::	cpe:2.3:a:teslamate:teslamate::::::::
Vendors & Products	Teslamate Project Teslamate Project teslamate	Teslamate Teslamate teslamate

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-01-24T18:07:18

Updated: 2024-08-03T03:36:19.699Z

Reserved: 2022-01-11T00:00:00

Link: CVE-2022-23126

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-01-24T19:15:08.447

Modified: 2025-05-28T21:48:43.560

Link: CVE-2022-23126

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login access to obtain a token for Tesla API calls."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-01-24T18:07:18", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/adriankumpf/teslamate/commit/fff6915e7364f83b3030f980d5743299c4e5260d"}, {"tags": ["x_refsource_MISC"], "url": "https://twitter.com/teslascope/status/1481252837174624258"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/adriankumpf/teslamate/compare/v1.25.0...v1.25.1"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/adriankumpf/teslamate/releases/tag/v1.25.1"}, {"tags": ["x_refsource_MISC"], "url": "https://medium.com/%40david_colombo/how-i-got-access-to-25-teslas-around-the-world-by-accident-and-curiosity-8b9ef040a028"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2022-23126", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login access to obtain a token for Tesla API calls."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/adriankumpf/teslamate/commit/fff6915e7364f83b3030f980d5743299c4e5260d", "refsource": "MISC", "url": "https://github.com/adriankumpf/teslamate/commit/fff6915e7364f83b3030f980d5743299c4e5260d"}, {"name": "https://twitter.com/teslascope/status/1481252837174624258", "refsource": "MISC", "url": "https://twitter.com/teslascope/status/1481252837174624258"}, {"name": "https://github.com/adriankumpf/teslamate/compare/v1.25.0...v1.25.1", "refsource": "MISC", "url": "https://github.com/adriankumpf/teslamate/compare/v1.25.0...v1.25.1"}, {"name": "https://github.com/adriankumpf/teslamate/releases/tag/v1.25.1", "refsource": "CONFIRM", "url": "https://github.com/adriankumpf/teslamate/releases/tag/v1.25.1"}, {"name": "https://medium.com/@david_colombo/how-i-got-access-to-25-teslas-around-the-world-by-accident-and-curiosity-8b9ef040a028", "refsource": "MISC", "url": "https://medium.com/@david_colombo/how-i-got-access-to-25-teslas-around-the-world-by-accident-and-curiosity-8b9ef040a028"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:36:19.699Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/adriankumpf/teslamate/commit/fff6915e7364f83b3030f980d5743299c4e5260d"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://twitter.com/teslascope/status/1481252837174624258"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/adriankumpf/teslamate/compare/v1.25.0...v1.25.1"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/adriankumpf/teslamate/releases/tag/v1.25.1"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://medium.com/%40david_colombo/how-i-got-access-to-25-teslas-around-the-world-by-accident-and-curiosity-8b9ef040a028"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2022-23126", "datePublished": "2022-01-24T18:07:18", "dateReserved": "2022-01-11T00:00:00", "dateUpdated": "2024-08-03T03:36:19.699Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:teslamate:teslamate:*:*:*:*:*:*:*:*", "matchCriteriaId": "DEAD2F2E-391D-4267-909C-C0D97ACD179D", "versionEndExcluding": "1.25.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login access to obtain a token for Tesla API calls."}, {"lang": "es", "value": "TeslaMate versiones anteriores a 1.25.1, (cuando es usada la configuraci\u00f3n predeterminada de Docker) permite a atacantes abrir las puertas de los veh\u00edculos Tesla, iniciar la conducci\u00f3n sin llave e interferir en el funcionamiento del veh\u00edculo en ruta. Esto ocurre porque un atacante puede aprovechar el acceso de inicio de sesi\u00f3n de Grafana para obtener un token para las llamadas a la API de Tesla"}], "id": "CVE-2022-23126", "lastModified": "2025-05-28T21:48:43.560", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-01-24T19:15:08.447", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/adriankumpf/teslamate/commit/fff6915e7364f83b3030f980d5743299c4e5260d"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/adriankumpf/teslamate/compare/v1.25.0...v1.25.1"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/adriankumpf/teslamate/releases/tag/v1.25.1"}, {"source": "cve@mitre.org", "url": "https://medium.com/%40david_colombo/how-i-got-access-to-25-teslas-around-the-world-by-accident-and-curiosity-8b9ef040a028"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://twitter.com/teslascope/status/1481252837174624258"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/adriankumpf/teslamate/commit/fff6915e7364f83b3030f980d5743299c4e5260d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/adriankumpf/teslamate/compare/v1.25.0...v1.25.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/adriankumpf/teslamate/releases/tag/v1.25.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://medium.com/%40david_colombo/how-i-got-access-to-25-teslas-around-the-world-by-accident-and-curiosity-8b9ef040a028"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://twitter.com/teslascope/status/1481252837174624258"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}