CVE-2022-37709

Tesla Model 3 V11.0(2022.4.5.1 6b701552d7a6) Tesla mobile app v4.23 is vulnerable to Authentication Bypass by spoofing. Tesla Model 3's Phone Key authentication is vulnerable to Man-in-the-middle attacks in the BLE channel. It allows attackers to open a door and drive the car away by leveraging access to a legitimate Phone Key.

• CWE-290

• https://fmsh-seclab.github.io/Exploit, Technical Description, Third Party Advisory
• https://github.com/fmsh-seclab/TesMlaThird Party Advisory
• https://youtu.be/cPhYW5FzA9AExploit, Third Party Advisory
• https://fmsh-seclab.github.io/Exploit, Technical Description, Third Party Advisory
• https://github.com/fmsh-seclab/TesMlaThird Party Advisory
• https://youtu.be/cPhYW5FzA9AExploit, Third Party Advisory

Published

Sep 16, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-37700Zentao Demo15 is vulnerable to Directory Traversal. The impa…7.5
• CVE-2022-37703In Amanda 3.5.1, an information leak vulnerability was found…3.3
• CVE-2022-37704Amanda 3.5.1 allows privilege escalation from the regular us…6.7
• CVE-2022-37705A privilege escalation flaw was found in Amanda 3.5.1 in whi…6.7
• CVE-2022-37706enlightenment_sys in Enlightenment before 0.25.4 allows loca…7.8
• CVE-2022-37708Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-3771A vulnerability, which was classified as critical, has been …9.8
• CVE-2022-37710Patterson Dental Eaglesoft 21 has AES-256 encryption but the…7.8
• CVE-2022-37718The management portal component of JetNexus/EdgeNexus ADC 4.…8.8
• CVE-2022-37719A Cross-Site Request Forgery (CSRF) in the management portal…8.8
• CVE-2022-3772Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-37720Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Sit…9