{"id":"CVE-2016-9337","url":"https://www.cyber-defence.io/tools/cve/CVE-2016-9337","generatedAt":"2026-10-28T21:57:12.841Z","title":"The vehicle's Gateway ECU is susceptible to commands that may allow an attacker to install malicious software allowing the attacker to send messages to the vehicle's CAN bus, a Command Injection.","description":"An issue was discovered in Tesla Motors Model S automobile, all firmware versions before version 7.1 (2.36.31) with web browser functionality enabled. The vehicle's Gateway ECU is susceptible to commands that may allow an attacker to install malicious software allowing the attacker to send messages to the vehicle's CAN bus, a Command Injection.","published":"2017-02-13T21:59:02.000Z","lastModified":"2026-06-17T00:55:51.000Z","status":"Modified","sourceIdentifier":"ics-cert@hq.dhs.gov","cvss":{"version":"3.0","score":6.8,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"},"cwe":["CWE-77"],"affected":["tesla/gateway ecu"],"epss":{"score":0.01715,"percentile":0.77288,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.71%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/94697","tags":["Third Party Advisory","VDB Entry"],"source":"ics-cert@hq.dhs.gov"},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-16-341-01","tags":["Third Party Advisory","US Government Resource"],"source":"ics-cert@hq.dhs.gov"},{"url":"http://www.securityfocus.com/bid/94697","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-16-341-01","tags":["Third Party Advisory","US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-9337","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}