Rapid7 researchers have detailed some security vulnerabilities in the Tesla Backup Gateway and the ways in which they can be exploited.
On Tuesday, Rapid7 outlined the security risks associated with connecting the Tesla Backup Gateway to the internet, specifically how open connections can be used to compromise users' privacy and security.
The Tesla Backup Gateway is a platform designed by the automaker to manage solar and battery/Powerwall installations. The system can connect directly to the grid, monitor outages, and allows users to monitor and control energy storage through a connected mobile app. Connections can be made via wifi, Ethernet cable , or cellular.
To access the gateway, users connect to the software’s wifi network, enter its serial number – which acts as a password – and access the Tesla Backup Gateway from an internet browser. Each gateway uses a self-signed SSL.
The first time a user logs in, the email and password are used – the last five digits of the gateway password.
According to Rapid7 and previous research conducted by Vince Loschiavo, the risk of this practice is that weak credentials.
In the worst case, five digits for first-time logins leads to 60.4 million password , and the team says there appear to be no restrictions in place to stop brute-force attack.
The access point SSID uses the last three characters of the serial number, leaving only two for hackers to guess.
Rapid7 also notes that many are posting their Tesla Solar and Powerwall home installation permits online, giving attackers direction to potential targets.
When the gateway connects to a local network, its hostname is broadcast using the full serial number. A number of Tesla Backup Gateway installations were also found, available and accessible online .
Rapid7 contacted Tesla before the research was published, and the company said that upcoming security updates will include fixes for the issues reported.
