Two German security researchers managed to create an autonomous exploit chain that starts with a single plug-in at a Tesla Universal Wall Connector, and which ended with control over two electric vehicle chargers of different brands.
Tobias Scharnowski and Kristian Covic of security vendor Fuzzware.io demonstrated the wormable exploit chain at the Black Hat USA conference earlier this month which, after the initial cable connection, happened without operator input, the researchers said.
Such self-spreading capability means the malware meets the standard definition of a worm.
Scharnowski and Covic called their presentation “Pedal to the Bare Metal” and their demo saw it move from the Wall Connector firmware to an Alpine infotainment unit over wi-fi; then, it moved from the infotainment system to an Autel MaxiCharger, and a ChargePoint Home Flex over wireless Bluetooth.
Tesla Charging has confirmed the bug and said it was patched late last year and deployed to its fleet of chargers.
This was patched in late 2025 and already deployed to our fleet. We appreciate https://t.co/dZhzkqKXJn for working with us. It’s great to have a community of security researchers that helps us keep our products safe and secure.
— Tesla Charging (@TeslaCharging) August 22, 2026
Getting an opening into the Wall Connector firmware was no easy feat: it comprises bare-metal Arm Cortex-M4 processor instruction code, with no public source to review or debug symbols, something that has made it fuzzing resistant in the past.
However, the researchers used “rehosting” or emulating the Wall Connector firmware in software rather than manually fuzzing (trying unexpected input) the physical hardware; this enabled them to test more than 1000 inputs per second rather than just one every few seconds and enabled them to find the new bug.
The bug that gave them code execution was a signed integer in the Wall Connector firmware, parsed during signature verification, that could be driven negative to trigger a large out-of-bounds write to the stack.
Separately, the Fuzzware.io researchers found a way to bypass the Wall Connector secure boot process, and to load unsigned code before signature validation.
This made the malicious exploit code persist in flash memory, and blocked future updates.
Their work builds on the same charge-port entry point pen-testing company Synacktiv used in a 2025 Pwn2Own Automotive attack on the Wall Connector.
It follows Fuzzware.io’s win of this year’s Pwn2Own Automotive “Master of Pwn” title, where Scharnowski, Covic and fellow researcher Felix Buchmann collected US$215,500 across seven demonstrations.
The researchers acknowledged the limitations of their work, such as running the exploit chain on Pwn2Own hardware.
“What we did not demonstrate, and want to be explicit about: internet-wide prevalence of vulnerable versions, propagation across arbitrary vehicles or chargers, or anything approaching grid destabilisation,” Scharnowski said.
