Two researchers from the security firm Fuzzware.io built a worm that can crawl from a Tesla home charger into an Alpine infotainment system and from there into Autel and ChargePoint charging gear. Tobias Scharnowski and Kristian Covic showed the self-spreading chain at Black Hat USA earlier this month, and it ran end to end with no operator input after the first cable connection.
The attack starts at a Tesla Universal Wall Connector. The bug behind the code execution is a signed integer in the charger firmware that gets parsed during signature verification; driving it negative triggers a large out-of-bounds write to the stack. The pair also bypassed secure boot, letting unsigned code load before signature validation runs. That made the malware stick in flash memory and block later firmware updates.
In the demo, the infection left the Wall Connector over Wi-Fi and landed on an Alpine head unit, then bridged to an Autel MaxiCharger and a ChargePoint Home Flex over Bluetooth. Tesla acknowledged the bug and said the fix shipped in late 2025, with the updated firmware already rolled out across its charging hardware.
Rather than fuzzing the physical hardware, the pair emulated the Wall Connector’s firmware in software, pushing their test rate past 1,000 inputs per second. The device normally resists that approach: it ships as bare-metal Arm Cortex-M4 machine code with no public source and no debug symbols to lean on.
The work builds on the charge-port entry point that Synacktiv used in its 2025 Pwn2Own Automotive attack on the Wall Connector. Fuzzware.io took this year’s Master of Pwn title, banking $215K across seven demos with Felix Buchmann. Scharnowski stressed the limits: no proof of internet-wide exposure, no spread across arbitrary vehicles or chargers, and nothing resembling grid destabilization.
