Yes, researchers demonstrated a zero-click Wi-Fi exploit against a Tesla Model 3’s infotainment computer—but “remotely” meant from nearby, using a drone to carry Wi-Fi equipment to a parked car, not an attack launched over the internet. The demonstration reached the infotainment system and a limited vehicle function; it did not give the researchers control of driving. A 2021 report said Tesla patched the vulnerability in October 2020, so TBONE is a historical security incident, not evidence of a current exploit against up-to-date Teslas.
What was the Tesla TBONE exploit?
TBONE was a 2020 security research demonstration by Ralf-Philipp Weinmann and Benedikt Schmotzle of Comsecuris. Their write-up, dated October 16, 2020, described an attack on the infotainment computer (CID) of a Tesla Model 3 over Wi-Fi. The planned submission was for Pwn2Own 2020, which was cancelled during the COVID-19 pandemic; the researchers later reported the issue to Tesla through its bug bounty program. The TBONE write-up is available as a reproduction of the authors’ document.
![Hot Wheels Tesla Cybertruck, HW Rolling Metal 4/5 [Silver] 246/250](https://m.media-amazon.com/images/I/41cHfq3xO0L._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
The attack combined two bugs in ConnMan, a network connection manager: a stack overflow in its DNS forwarder and a stack information leak in its DHCP component. Together, the bugs enabled remote code execution in the infotainment system. The authors noted that relevant kernel modules were signed, so gaining control of ConnMan did not immediately provide root access.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhat did the drone have to do with it?
The drone carried Wi-Fi equipment close to the target vehicle. In a 2021 report, Australian Computer Society publication Information Age said the researchers demonstrated the attack with a drone carrying a Wi-Fi dongle up to 100 metres from a parked Tesla, without driver interaction. That distance describes the reported demonstration; it does not mean an attacker could exploit a car from anywhere within a 100-metre radius without suitable conditions and equipment.
#1 Best Overall
“Zero-click” means the target driver did not need to open a link, approve a prompt or otherwise interact for the exploit to work. “Remote” describes the lack of a direct physical connection to the car, not an internet-originating attack. The demonstration still depended on Wi-Fi proximity to the parked vehicle. Information Age’s report describes the drone demonstration and its reported capabilities.
Could hackers drive the Tesla?
No. The reporting says the exploit did not let an attacker drive the car. The researchers demonstrated disabling the firewall and sending a message to the vehicle gateway to open the charge port; their write-up says: “For demonstration purposes, we shut down the firewall and send a message to the gateway to open the charge port of the car.”
Rank #2
- Hot Wheels 2022 Tesla Cybertruck
Information Age also attributed other potential functions to the researchers, including interfering with the console, opening doors, changing seat positions, and changing steering or acceleration modes. Those reported capabilities should not be confused with proof that the car was driven, or that access to those settings amounted to control of the vehicle in motion.
Did Tesla patch the drone hack?
Information Age reported that Tesla patched the vulnerability through an update in October 2020 and reportedly stopped using ConnMan. This is a contemporaneous report about remediation, not a fleet-wide audit of every model year, region or software version. The available reporting does not establish the number of vehicles that were affected or provide a current assessment of every configuration.
Rank #3
- Authentic Match Box Design: Premium-quality die-cast replica of the Tesla Cybertrucks (Grey) featuring realistic detailing and moving parts.
- Functional Moving Parts: Includes opening and closing features for added realism — perfect for collectors and imaginative play.
- Premium Finish: Eye-catching metallic blue paint with detailed interiors and authentic branding for a true-to-life look.
- Ideal Gift for Kids & Collectors: Great choice for children aged 3+ and adult collectors who love Hot Wheels & Match Box scale models.
- Durable & Collectible: Built from sturdy materials, perfect for long-lasting use, playtime adventures, or proudly displaying in your die-cast collection.
The practical takeaway is that TBONE does not show that an up-to-date Tesla can now be hacked in this way. It documents a vulnerability that was reported and patched years ago; claims that the same exploit remains active need separate, current evidence.
How should researchers report a Tesla security issue now?
Tesla’s Product Security policy, accessed October 4, 2026, directs vehicle and product vulnerability reports to [email protected]. For sensitive reports, Tesla asks researchers to use its PGP key. Bugcrowd is described as a platform Tesla uses for rewarding issues; it is not a substitute for following the policy’s reporting and testing rules.
Rank #4
- Remote Controlled Tesla Cybertruck!
- Includes Car and Remote Control! Track/Accessories Sold Seperately!
- 1:64 Scale Diecast Toy Vehicle
- Test only vehicles you own or have permission to access, and do not compromise vehicle safety.
- Provide enough information for Tesla to reproduce and validate the issue; avoid privacy violations and service disruption.
- Give Tesla reasonable time to address a vulnerability before public disclosure.
- For vehicle research, follow the policy’s scope for infotainment, gateway, Tesla-developed ECU and energy-product security mechanisms. The policy also describes requesting pre-approval and registering a research vehicle.
Tesla’s policy says vulnerabilities implicating functionality not resident on a research-registered vehicle must be reported within 168 hours (seven days). That is a policy deadline, not a measure of how often such issues occur. See Tesla Product Security for current scope and submission details.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Is newer Tesla wireless-security research the same as TBONE?
No. A separate 2026 repository from Northeastern University researchers describes a black-box study of LTE connectivity in Tesla Model 3 and Cybertruck vehicles. Its authors describe a local wireless-adversary scenario and say the findings do not demonstrate remote code execution, CAN-bus access or takeover of driving functions. That work should not be treated as proof that TBONE remains exploitable or as a continuation of the same demonstrated attack. The study repository describes that separate project.
Quick Recap
Best Value
- AUTHENTIC DESIGN: Precisely detailed remote control model featuring angular futuristic styling, metallic silver finish, and distinctive geometric body shape
- REMOTE CONTROL: Full function RC operation lets you drive this miniature electric truck forward, backward, and steer with responsive controls
- LIGHTING FEATURES: Equipped with LED lights that illuminate while driving for enhanced realism and nighttime play
- AGE APPROPRIATE: Perfect for children 3 years and older, with easy-to-use controls and durable construction for lasting enjoyment
- SPECIFICATIONS: Battery-operated RC vehicle includes remote control unit, requires batteries (not included), sized for indoor and outdoor play
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
