CVE-2023-31634
📋 TL;DR
This vulnerability allows unauthenticated attackers to access TeslaMate's Grafana dashboard on port 3000 after discovering the instance on port 4000. Attackers can use default credentials to gain administrative access to view and manipulate Tesla vehicle data. This affects all TeslaMate instances before version 1.27.2 that are exposed to untrusted networks.
💻 Affected Systems
- TeslaMate
📦 What is this software?
Teslamate by Teslamate
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Tesla vehicle data including location history, driving patterns, charging data, and potential remote vehicle operations if integrated with Tesla API.
Likely Case
Unauthorized access to sensitive Tesla owner data including location tracking, driving habits, and personal information stored in Grafana dashboards.
If Mitigated
Limited to internal network access only, requiring attacker to already have network access to reach the TeslaMate instance.
🎯 Exploit Status
Exploitation requires only network scanning to find port 4000, then switching to port 3000 and using default admin/admin credentials. Related to CVE-2022-23126 which had similar Grafana default credential issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.27.2
Vendor Advisory: https://github.com/adriankumpf/teslamate/releases/tag/v1.27.2
Restart Required: Yes
Instructions:
1. Backup your TeslaMate database and configuration. 2. Update to TeslaMate version 1.27.2 or later. 3. Change default Grafana credentials immediately. 4. Restart all TeslaMate and Grafana services. 5. Verify services are running on updated versions.
🔧 Temporary Workarounds
Change Grafana Default Credentials
linuxImmediately change the default admin/admin credentials in Grafana to prevent unauthorized access.
docker exec -it teslamate_grafana grafana-cli admin reset-admin-password <new_password>
Network Access Control
linuxRestrict access to ports 4000 and 3000 using firewall rules to only trusted IP addresses.
sudo ufw allow from 192.168.1.0/24 to any port 4000,3000
sudo ufw deny 4000
sudo ufw deny 3000
🧯 If You Can't Patch
- Immediately change Grafana admin password from default 'admin/admin'
- Implement strict firewall rules to block external access to ports 4000 and 3000
🔍 How to Verify
Check if Vulnerable:
Check if TeslaMate is accessible on port 4000 and Grafana on port 3000 with default credentials. Use: curl -v http://<ip>:4000 and attempt login at http://<ip>:3000 with admin/admin.Check Version:
docker exec teslamate_app cat /app/teslamate/VERSION 2>/dev/null || grep version /opt/teslamate/config.exsVerify Fix Applied:
Verify TeslaMate version is 1.27.2 or later and Grafana requires authentication with non-default credentials. Test that default credentials no longer work.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts on Grafana with default credentials
- Unauthorized access to /api/dashboards or /api/datasources endpoints
- Multiple connection attempts from single IP to ports 4000 and 3000
Network Indicators:
- Port scanning activity targeting port 4000 followed by connections to port 3000
- HTTP requests to Grafana login endpoint from unexpected sources
- Traffic patterns showing sequential access to :4000 then :3000
SIEM Query:
source="*grafana*" AND (event="login failed" AND user="admin") OR (event="login success" AND src_ip NOT IN [trusted_ips])