Causal model
What has to happen for this consequence to hold?
2 candidate paths · explicit source, inference, and assumption boundaries.
Safety · Co-dominant path
Device-control safety
Demonstrated gateway control can open the front trunk or a door while the car is moving, creating a credible dangerous-actuation risk.
Per-device physical access
Position requires prior privileged foothold on infotainment then lateral move to the Gateway ECU (internal, not open-net).
EvidenceNVD
Cross-domain authority chain
Cross-domain bridge: app and infotainment to internal bus to physical actuation crosses multiple boundaries and is a reusable pivot.
EvidenceNo direct citation — inspect the declared inference or assumption.
Severe therapy or actuation consequence
Demonstrated gateway control can open the front trunk or a door while the car is moving, creating a credible dangerous-actuation risk.
EvidenceNo direct citation — inspect the declared inference or assumption.
Device-control safety
Demonstrated gateway control can open the front trunk or a door while the car is moving, creating a credible dangerous-actuation risk.
EvidenceNo direct citation — inspect the declared inference or assumption.
Patch, reset, or reconfiguration
Recoverable through a firmware update.
EvidenceNo direct citation — inspect the declared inference or assumption.
Decision rationale
Why this band?
The compact score is separated into the facts and judgments that produced it.
Reach and effort
- Reachability
RE 1 - Per-device physical access
Position requires prior privileged foothold on infotainment then lateral move to the Gateway ECU (internal, not open-net).
- Execution complexity
EC 3 - Reproducible exploit workflow
The Gateway step itself is low-complexity but reaching it needs the chained foothold is standard-to-advanced researcher workflow.
- Exposure
EX 1 - Access position limits exposure
The technique is easier to perform than it is to position against a target, so access is the constraining factor.
Consequence
- Physical / safety
PH 4 - Severe therapy or actuation consequence
Demonstrated gateway control can open the front trunk or a door while the car is moving, creating a credible dangerous-actuation risk.
- Data / perception
DP 3 - Sensitive device or personal data
Gateway compromise exposes vehicle configuration, command, and operational state rather than relying on personal data or a separate perception feed.
- Authority
AT 3 - Administrative or command authority
The path reaches administrative control over vehicle command functions, but not the gateway signing or firmware trust root.
Scale and recovery
- Chainability
CH 4 - Cross-domain authority chain
Cross-domain bridge: app and infotainment to internal bus to physical actuation crosses multiple boundaries and is a reusable pivot.
- Reuse scale
SR 3 - Portable product-class technique
Reusable across Model 3 on affected firmware given foothold.
- Execution scale
SX 3 - Deployment-wide with setup
Deployment-wide with the prerequisite setup, no per-device physical touch beyond the chain.
- Recovery burden
OR 2 - Patch, reset, or reconfiguration
Recoverable through a firmware update.
Confidence and status
- Evidence strength
EV 3 - Reproduced or strongly report-backed
NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.
- Liveness
LS Patch available - A patch is available
A vendor fix is available, while deployment and upgrade completion remain separate operational questions.
Decision trail
How the final band follows
- Base bandCRITICAL
- No adjustment
The CRITICAL base band remains final because no separate cap or systemic uplift applies. Demonstrated gateway control can open the front trunk or a door while the car is moving, creating a credible dangerous-actuation risk.
- Final candidate bandCRITICAL
Technical vector
CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:1/EC:3/EX:1/PH:4/DP:3/AT:3/CH:4/SR:3/SX:3/OR:2/EV:3/LS:PATCH_AVAILABLERead the scoring method →Authority · Co-dominant path
Firmware trust root
A time-of-check and time-of-use flaw bypasses signature validation in the gateway update path, allowing untrusted code to run on a central vehicle controller.
Per-device physical access
Position requires prior infotainment code execution then adjacency to the Gateway update path.
EvidenceNVD
Cross-domain authority chain
Crosses update and firmware and device boundaries and is a reusable bridge to persistent control.
EvidenceNo direct citation — inspect the declared inference or assumption.
Firmware or trust-root authority
A time-of-check and time-of-use flaw bypasses signature validation in the gateway update path, allowing untrusted code to run on a central vehicle controller.
EvidenceNo direct citation — inspect the declared inference or assumption.
Firmware trust root
A time-of-check and time-of-use flaw bypasses signature validation in the gateway update path, allowing untrusted code to run on a central vehicle controller.
EvidenceNo direct citation — inspect the declared inference or assumption.
Coordinated operational recovery
Persistent malicious firmware on the control bridge raises recovery cost beyond a single patch action though Tesla shipped a firmware-update fix.
EvidenceNo direct citation — inspect the declared inference or assumption.
Decision rationale
Why this band?
The compact score is separated into the facts and judgments that produced it.
Reach and effort
- Reachability
RE 1 - Per-device physical access
Position requires prior infotainment code execution then adjacency to the Gateway update path.
- Execution complexity
EC 3 - Reproducible exploit workflow
Standard researcher workflow once positioned, Gateway step but chain-dependent.
- Exposure
EX 1 - Access position limits exposure
The technique is easier to perform than it is to position against a target, so access is the constraining factor.
Consequence
- Physical / safety
PH 3 - Credible safety consequence
Safety-relevant since the compromised ECU governs actuation.
- Data / perception
DP 3 - Sensitive device or personal data
Gateway firmware access can expose proprietary code, configuration, and embedded security material.
- Authority
AT 4 - Firmware or trust-root authority
A time-of-check and time-of-use flaw bypasses signature validation in the gateway update path, allowing untrusted code to run on a central vehicle controller.
Scale and recovery
- Chainability
CH 4 - Cross-domain authority chain
Crosses update and firmware and device boundaries and is a reusable bridge to persistent control.
- Reuse scale
SR 4 - Shared fleet-wide primitive
Defeating signature checking is a portable, reusable secret and logic defect applicable across identical units and firmware is supply-chain and trust-mechanism reuse.
- Execution scale
SX 3 - Deployment-wide with setup
After the prerequisite infotainment foothold is available, the Gateway update-path technique can be repeated across affected vehicles without opening each ECU.
- Recovery burden
OR 3 - Coordinated operational recovery
Persistent malicious firmware on the control bridge raises recovery cost beyond a single patch action though Tesla shipped a firmware-update fix.
Confidence and status
- Evidence strength
EV 3 - Reproduced or strongly report-backed
NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.
- Liveness
LS Patch available - A patch is available
A vendor fix is available, while deployment and upgrade completion remain separate operational questions.
Decision trail
How the final band follows
- Base bandCRITICAL
- No adjustment
The CRITICAL base band remains final because no separate cap or systemic uplift applies. A time-of-check and time-of-use flaw bypasses signature validation in the gateway update path, allowing untrusted code to run on a central vehicle controller.
- Final candidate bandCRITICAL
Technical vector
CPATH:1.0-candidate/TT:FIRMWARE_TRUST_ROOT/RE:1/EC:3/EX:1/PH:3/DP:3/AT:4/CH:4/SR:4/SX:3/OR:3/EV:3/LS:PATCH_AVAILABLERead the scoring method →Triage implication
Verify the safety transition before acting on the band.
Validate the deployment-specific transition from digital control or perception to physical action before setting remediation urgency.
Evidence ledger
Public sources used by this record.
Every named source includes a public link. Path review remains separate from citation coverage.
- advisoryNVD
NVD
Published baseline
Keep exploit severity and consequence reasoning distinct.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVE recordsCVE-2023-32156
Original scorer notes
The source narrative behind the structured explanation.
Retained for provenance and historical review, not as the recommended way to understand the assessment.
Read the original scorer notes
Assessment
CFSE Consequence Paths assesses Tesla Model 3 Gateway Firmware Signature-Bypass / TOCTTOU Code Execution (CVE-2023-32156) at CRITICAL — the worst of 2 risk paths (safety, authority). The dominant consequence is influence over a safety-relevant actuation.
Vulnerability
Tesla Model 3 Gateway Firmware Signature-Bypass / TOCTTOU Code Execution (CVE-2023-32156). Reported attack vector: Adjacent network (requires prior code execution on infotainment to reach Gateway).
CFSE Consequence Paths analysis
The vulnerability is decomposed into one risk path per terminal consequence. Each path is scored on its exposure (reachability × execution complexity) and the authority, perception, and physical/safety it reaches, together with its scale of reuse, scale of execution, and recoverability.
DEVICE_CONTROL_SAFETY → CRITICAL
CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:1/EC:3/EX:1/PH:4/DP:3/AT:3/CH:4/SR:3/SX:3/OR:2/EV:3/LS:PATCH_AVAILABLE
Exposure EX=1 (reachability-bound) · bands PH=CRITICAL · DP=HIGH · AT=HIGH → base CRITICAL · caps low-exposure cap → assessed CRITICAL.
- Gateway code execution mediates commands to vehicle subsystems; demonstrated opening front trunk/door while car in motion = credible dangerous actuation (PH:4). Position requires prior privileged foothold on infotainment then lateral move to the Gateway ECU (internal, not open-net), so RE:1. The Gateway step itself is low-complexity but reaching it needs the chained foothold = standard-to-advanced researcher workflow (EC:3). Authority is over the vehicle control plane / command path = admin/service-level control (AT:3, not trust-root). Cross-domain bridge: app/infotainment -> internal bus -> physical actuation crosses multiple boundaries and is a reusable pivot (CH:4, boundary_crossing). Reusable across Model 3 on affected firmware given foothold (SR:3); deployment-wide with the prerequisite setup, no per-device physical touch beyond the chain (SX:3). OTA-recoverable (OR:2). Reproduced at Pwn2Own 2023 (EV:3).
- perception_feeds_action — false: this is direct command/actuation, not manipulated perception driving action.
FIRMWARE_TRUST_ROOT → CRITICAL
CPATH:1.0-candidate/TT:FIRMWARE_TRUST_ROOT/RE:1/EC:3/EX:1/PH:4/DP:3/AT:4/CH:4/SR:4/SX:3/OR:3/EV:3/LS:PATCH_AVAILABLE
Exposure EX=1 (reachability-bound) · bands PH=CRITICAL · DP=HIGH · AT=HIGH → base CRITICAL · caps low-exposure cap → assessed CRITICAL.
- The core defect is a signature-validation bypass (TOCTTOU) in the Gateway firmware update mechanism: it defeats firmware authenticity enforcement on a central ECU, letting an attacker run arbitrary unsigned code = subversion of the firmware trust root for that component (AT:4). Position requires prior infotainment code execution then adjacency to the Gateway update path (RE:1). Standard researcher workflow once positioned, Gateway step AC:L but chain-dependent (EC:3). Defeating signature checking is a portable, reusable secret/logic defect applicable across identical units/firmware = supply-chain/trust-mechanism reuse (SR:4); deployment-wide with setup (SX:3). Persistent malicious firmware on the control bridge raises recovery cost beyond a single patch action though Tesla shipped an OTA fix (OR:3). Crosses update/firmware/device boundaries and is a reusable bridge to persistent control (CH:4). Safety-relevant since the compromised ECU governs actuation (PH:3). Firmware/proprietary op-state exposure DP:3. Reproduced (EV:3).
- perception_feeds_action — false.
Published baseline
- v3.1 8.8 HIGH —
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H— NVD - v3.0 9 CRITICAL —
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H— ZDI via NVD
The published baseline above is retained for source review. Paths decomposes the consequence into authority, perception, safety, scale, and recoverability paths rather than using the baseline score as the primary registry frame.
Sources
CFSE Consequence Paths Registry 1.0-candidate, CPATH-2026-0019 (“Tesla Model 3 Gateway Firmware Signature-Bypass / TOCTTOU Code Execution (CVE-2023-32156)”), paths.cfse.ai/CPATH-2026-0019 (published 2026-06-03).