Researchers demo 0-click RCE on Tesla Model 3 via Bluetooth TPMS sensors
matthew_d_green · x · 2026-10-19
Security firm SYNACKTIV demonstrated a 0-click remote code execution attack on the Tesla Model 3, using the tire-pressure monitoring system as the entry point.
- Older TPMS units used 433 MHz radio; modern ones rely on Bluetooth Low Energy, and Tesla cars expose 5 BLE endpoints (Center/Left/Right/Rear/Rear Left) to locate the sensors.
- Attack chain: an attacker ESP32 "Racer" races and occupies the TPMS connection so the car's VCSEC module can't reach it; after 90 seconds VCSEC unenrolls the sensor and starts auto-learning; a second attacker ESP32 simulating a new TPMS then gets enrolled by the car, triggering the exploit.
The attack requires no user interaction, highlighting a new attack surface introduced by BLE-based body electronics.
More from Embodied
- Scoble: 'What if robots never touch anything?' talk helped store lift sales 258% — Scobleizer · 2026-10-19
- ASUS Ascent GX10 (GB10) drops to ~$4,300 used on Amazon, 3 units left — AIFlow_ML · 2026-10-19
- FOMO-DEX from Amazon FAR, CMU and Berkeley uses force feedback to fix only contact commands — HaozhiQ · 2026-10-19
- Sim-ready humanoid character revealed, RL experiments coming next — _Stocko_ · 2026-10-19
- Open-source ROS 2 LiDAR localization runs 390 m outdoors on handheld Livox MID-360 — rsasaki0109 · 2026-10-19
- Microsoft Research intern builds a haptic robot that teaches physics through feel — plopesresearch · 2026-10-19