Quick Summary
- Researchers from Germany created a worm that targets Tesla’s Universal Wall Connector.
- The exploit chain was able to infect other EV chargers via Wi-Fi and Bluetooth.
- Tesla acknowledged and remedied the vulnerability by late 2025.
- Software emulation was employed by the researchers to identify the issue.
- The exploit was showcased during the Black Hat USA conference.
- They received accolades for their contributions at Pwn2Own Automotive.
Demonstration of Exploit Chain at Black Hat USA
At the Black Hat USA conference, two German security experts, Tobias Scharnowski and Kristian Covic from Fuzzware.io, showcased an innovative autonomous exploit chain. This exploit initiated from a simple plug-in at Tesla’s Universal Wall Connector and broadened its reach to control various electric vehicle (EV) chargers from multiple manufacturers.
The Wormable Exploit Chain
The researchers titled their presentation “Pedal to the Bare Metal,” illustrating how the exploit transitioned effortlessly from Tesla’s Wall Connector firmware to an Alpine infotainment unit using Wi-Fi, and then to an Autel MaxiCharger and a ChargePoint Home Flex via Bluetooth. This capability to self-replicate qualifies the malware as a worm.
Tesla’s Reaction and Patch Release
Tesla Charging confirmed the bug’s presence and indicated that it was fixed and rolled out to its vehicles by late 2025. They thanked the security sector for their teamwork in ensuring product safety and security.
Technical Aspects of the Exploit
Accessing the Wall Connector Firmware
The firmware of the Wall Connector presented considerable obstacles due to its bare-metal Arm Cortex-M4 processor instruction set, which lacked publicly accessible source or debug symbols and was historically difficult to fuzz. Nonetheless, Scharnowski and Covic utilized “rehosting” or software emulation, enabling them to test over 1000 inputs per second, which uncovered a significant flaw.
Exploit and Code Execution
The identified flaw involved a signed integer in the firmware that could be exploited to trigger a large out-of-bounds write to the stack during the signature verification process. Furthermore, they circumvented the secure boot procedure, allowing execution of unsigned code and preventing subsequent updates.
Achievements and Recognition
Their research built upon a similar charge-port exploit used in the 2025 Pwn2Own Automotive attack by Synacktiv. The team from Fuzzware.io, including Scharnowski, Covic, and Felix Buchmann, earned the Pwn2Own Automotive “Master of Pwn” award, accumulating US$215,500 across seven presentations.
Limitations and Notes
The researchers emphasized that their demonstration did not suggest a broad internet vulnerability or potential grid disruption, as the exploit was tested solely on Pwn2Own hardware.
Conclusion
The exhibition by Fuzzware.io’s researchers at Black Hat USA reveals significant vulnerabilities in the Tesla Universal Wall Connector, highlighting how such exploits could potentially propagate across various EV chargers. Although Tesla has addressed the vulnerability, this research underscores the necessity for ongoing security advancements within the swiftly evolving EV sector.
Q&A: Essential Questions Addressed
Q: What was the principal vulnerability exploited?
A: The vulnerability was attributed to a signed integer bug in the Wall Connector firmware, permitting a considerable out-of-bounds write to the stack.
Q: How did the researchers analyze the firmware?
A: They employed a method called “rehosting,” which allowed them to emulate the firmware in software and test over 1000 inputs each second.
Q: Did this exploit impact all Tesla Wall Connectors?
A: Tesla indicated that the vulnerability was patched and distributed to its fleet in late 2025, implying that affected models received updates.
Q: Was there any danger to the wider electric grid?
A: The researchers did not demonstrate or suggest any internet-wide vulnerability or threat to grid stability.
Q: What is the relevance of this exploit?
A: It emphasizes the necessity for strong security protocols in EV infrastructure, illustrating the potential dangers should such vulnerabilities be exploited.
Q: What accolade did the researchers receive for their efforts?
A: They earned the Pwn2Own Automotive “Master of Pwn” title, totaling US$215,500 across multiple demonstrations.
Q: How did Tesla react to the vulnerability?
A: Tesla promptly patched the vulnerability and expressed gratitude for the security community’s collaborative efforts.
