Introduction
Remote attackers can gain code execution on Tesla Wall Connector devices by exploiting a flaw in how the device parses HTTP Content-Length headers. This issue affects a widely deployed electric vehicle charging solution, potentially exposing home and business networks to compromise if left unpatched.
About Tesla Wall Connector: Tesla is a global leader in electric vehicles and energy solutions, with millions of Wall Connector units deployed in homes and businesses worldwide. The Wall Connector is a critical component of Tesla's charging infrastructure, supporting both residential and commercial environments. Its widespread adoption and network connectivity make it a high-value target for attackers seeking access to internal networks or to disrupt EV charging operations.
Technical Information
CVE-2025-8320 is a remote code execution vulnerability in Tesla Wall Connector devices. The root cause is improper input validation of the HTTP Content-Length header during HTTP request parsing. The device's firmware fails to enforce correct bounds checking on the Content-Length value, which can be manipulated by an attacker to cause memory access beyond the allocated buffer. This classic buffer overflow scenario allows a network-adjacent attacker to send a crafted HTTP request that triggers memory corruption and ultimately enables arbitrary code execution within the device's firmware context. No authentication is required for exploitation, and the vulnerable service is typically exposed on TCP port 80 or 34578, depending on device configuration. The vulnerability is classified under CWE-1284 (Improper Validation of Specified Quantity in Input). No public code snippets or proof of concept have been released for this issue.
Patch Information
Tesla has addressed a critical vulnerability in their Wall Connector devices, identified as ZDI-25-711, by releasing Firmware Version 24.44.3. This update rectifies an issue where improper validation of the HTTP Content-Length header could allow attackers to execute arbitrary code remotely. Users are strongly advised to update their devices to this latest firmware to ensure protection against potential exploits.
Patch Source:
Affected Systems and Versions
- Tesla Wall Connector Gen 3 devices running firmware versions prior to 24.44.3 are affected.
- The vulnerability is present in all configurations where the HTTP service is exposed on TCP port 80 or 34578.
- Only devices running firmware version 24.44.3 or later are protected.
Vendor Security History
Tesla has previously addressed security vulnerabilities in its products, such as CVE-2025-2082 affecting the Tesla Model 3. The company's response to reported vulnerabilities typically involves prompt over-the-air firmware updates. Tesla participates in bug bounty programs and has a track record of releasing fixes within weeks of disclosure for critical issues.