IoT Security

Tesla Charger Exploits Earn Hackers $129,000 at Pwn2Own

Hackers earned more than $700,000 on the first two days of Pwn2Own Automotive 2025 for EV charger and infotainment exploits.

Pwn2Own Tesla charger exploits

Significant rewards were earned by researchers on the second day of the Pwn2Own Automotive 2025 hacking competition organized this week by Trend Micro’s Zero Day Initiative (ZDI) in Tokyo, Japan. 

A total of $335,500 was paid out on the second day of the event, which, with the $382,750 awarded on the first day, brings the total to $718,250.

Of the second day’s total, $129,500 was earned for exploits targeting Tesla’s Wall Connector charger. 

One team earned $50,000 — the maximum amount for hacking the Tesla Wall Connector — for taking over the device and crashing it. 

Another team earned $45,000 for what ZDI described as an inventive Tesla charger exploit that leveraged the charging connector. 

Two other teams earned $22,500 and $12,500 rewards for hacking Tesla EV chargers — the amounts are smaller because the exploits involved previously known bugs.  

One more attempt to hack the Tesla Wall Connector is scheduled for Friday, which could add another $50,000 to the $129,500, if the exploit is successful.

Advertisement. Scroll to continue reading.

Other significant rewards were earned on the second day for Wolfbox ($50,000), Phoenix Contact ($25,000), Autel ($23,000) EV charger exploits. 

At Pwn2Own Automotive 2025, no one is scheduled to attempt a Tesla vehicle hack, for which the organizers had been prepared to hand out a car and up to $500,000 in cash for an autopilot exploit.

At last year’s event, participants earned a total of $1.3 million for exploits targeting Teslas, EV chargers and infotainment systems.

Related: Details Disclosed for Mercedes-Benz Infotainment Vulnerabilities

Related: Over $1 Million Paid Out at Pwn2Own Ireland 2024

Related: Synology, QNAP, TrueNAS Address Vulnerabilities Exploited at Pwn2Own Ireland

Related Content

Vulnerabilities

$1.2 million was paid out at Pwn2Own Ireland 2026 for exploits targeting phones, printers, smart speakers, smart home hubs, and AI infrastructure and coding...

Nation-State

The Chinese-language input method editor for Windows can allow attackers to execute arbitrary code remotely.

Endpoint Security

The exploit provides full System privileges on Windows machines running the September 2026 patches.

Vulnerabilities

The proof-of-concept (PoC) exploits lead to privilege escalation, spawning a shell with System privileges.

Artificial Intelligence

Forescout researchers used Claude AI to port a remote code execution exploit between WAGO PLC models.

Vulnerabilities

Dropped on Patch Tuesday, the exploit allows any user to spawn a shell with System privileges.

Vulnerabilities

CISA says threat actors are exploiting a recently patched SharePoint remote code execution vulnerability (CVE-2026-45659).

Mobile & Wireless

The vulnerability exploited by the Usbliter8 exploit cannot be patched and a PoC exploit has been released by researchers.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.

Exit mobile version