A fully up-to-date Tesla Wall Connector Gen 3 can still be downgraded through its own update path. The usual assumption that Tesla’s anti-downgrade ratchet makes a patched charger rollback-resistant is false here, because the sequencing bug lets attackers reach the old vulnerable firmware and drop into a debug shell.
Synacktiv says it bypassed the vendor’s new anti-downgrade check by abusing the order of operations between partition-table writes and slot erase. That replays the original Pwn2Own attack on the current firmware, which means the fix closed one path but not the update mechanism itself.
For operators, patch status is not proof that rollback paths are sealed. Chargers exposed to physical access or untrusted charge cables still have a firmware rollback and debug-shell risk even after the vendor update is installed.