Free tools Windows power users keep installed
One-click scans. No signup required.
Researchers earned a reported $718,250 through the first two days of Pwn2Own Automotive 2025, including demonstrations against a Tesla Wall Connector, EV chargers and in-car infotainment systems. That is the contest’s reported running total through day two—not a verified final event total.
How much did hackers win at Pwn2Own Automotive 2025?
Zero Day Initiative (ZDI), the contest organizer, reported $382,750 in awards on day one and another $335,500 on day two, for a cumulative $718,250 through day two. SecurityWeek independently reported the same two-day total. The available results establish the running total at that point, not the final amount awarded over the full event.
| Results point | Awards reported | Unique zero-days reported | Source and qualification |
|---|---|---|---|
| Day one | $382,750 | 16 | ZDI day-one results, published January 21, 2025 |
| Day two | $335,500 | 23 | ZDI day-two results, published January 22, 2025; the post gives the day’s awards and running total |
| Cumulative through day two | $718,250 | Not stated as a cumulative figure | ZDI day-two results and SecurityWeek, January 23, 2025 |
The ZDI results posts are dated January 21 and 22, while the official contest rules give the event dates as January 22–24, 2025. The post dates should not be mistaken for the contest period.
What did researchers hack at Pwn2Own Automotive?
The competition covered multiple automotive technology categories rather than only complete cars. Its targets included Tesla systems, in-vehicle infotainment (IVI), EV chargers and automotive operating systems. The official rules list a Tesla Model 3/Y with a Ryzen-based system or an equivalent bench-top unit, alongside specific infotainment and charging products.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
In-vehicle infotainment
The named IVI targets were the Sony XAV-AX8500, Alpine iLX-507, Pioneer DMH-WT7600NEX and Kenwood DMX958XR. ZDI’s first-day results describe, among other demonstrations, a stack-based buffer overflow against Alpine infotainment, OS command injection against Kenwood and an integer overflow against a Sony receiver.
ZDI explains that infotainment systems can provide navigation, in-car internet and Wi-Fi, and may connect with other vehicle systems through the CAN bus. That is the organizer’s description of why the category matters; it should not be read as a claim that every listed model has the same connections or exposure.
EV chargers
The rules named the ChargePoint Home Flex, Phoenix Contact CHARX SEC-3150, WOLFBOX Level 2, EMPORIA Level 2, Tesla Wall Connector, Autel MaxiCharger and Ubiquiti Connect EV Station. Day-one examples included a hard-coded cryptographic key issue involving a Ubiquiti charger. Day two featured a two-bug chain against WOLFBOX and a multi-bug exploit against an Autel charger, among other demonstrations.
Tesla and other vehicle systems
On day two, ZDI reported a logic-bug demonstration against a Tesla Wall Connector using a chain that began through the charging connector. SecurityWeek attributed $129,500 in day-two awards to Tesla Wall Connector exploits. That figure is SecurityWeek’s breakdown; ZDI’s contest-results post is the primary source for the individual demonstrations.
Was the Tesla Wall Connector hacked?
Researchers demonstrated an exploit chain against a Tesla Wall Connector in the controlled contest. ZDI describes a logic bug in a chain reached via the charging connector. This supports saying that a contest-target Wall Connector was successfully attacked under the competition’s rules; it does not establish that every production unit is vulnerable, that the same route works in ordinary use, or that a particular patch has been released.
More broadly, contest results document demonstrations against specific targets and conditions. They are not a model-by-model security audit of every device sold under a brand.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What were the contest rules and disclosure terms?
The official rules set the event in Tokyo, Japan, for January 22–24, 2025. They define acceptable attempts around services, protocols and interfaces accessible to a typical user, with category-specific exceptions and add-ons. Findings were expected to be unknown, unpublished and/or not previously reported, although the sponsor could accept known-bug cases at its discretion for reduced awards. Some result entries were marked as collisions because at least one bug was already known or had been demonstrated before.
Successful contestants had to provide a functioning exploit and a whitepaper describing the vulnerabilities and sequence of techniques. The rules state: “Vulnerabilities and exploit techniques revealed by contest winners will be disclosed to the affected vendors and the exploits and whitepapers will become the property of the Sponsor in accordance with the ZDI researcher agreement.” That clause describes the contest’s disclosure and ownership terms; it does not confirm that a vendor patch was released.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What the results do—and do not—show
The results show that security researchers could demonstrate attacks against a diverse set of contest targets, including chargers and infotainment systems, and that the first two days produced $718,250 in reported awards. To assess any individual finding beyond the contest, readers would need to distinguish the target and attack surface, the demonstrated result, whether the entry involved a new finding or a collision, and whether the vendor has issued a corresponding advisory or fix.
The published figures above do not establish day-three awards, a final event total or the final Master of Pwn winner. Nor do the contest demonstrations alone establish patch status or the exposure of all production products in a category.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
