An attacker might guess the password via a Tesla website, which Dhanjani says does not restrict the number of incorrect login attempts.

Attackers could try to gain access to the password from the user's computer via password-stealing viruses, or gain access to other accounts that might use the same password.

"It's a big issue where a $100,000 car should be relying on a six-character static password," he said.

Dhanjani said there is also evidence that Tesla support staff can unlock cars remotely, leaving car owners vulnerable to attackers impersonating them, and raising questions about the apparent power of such employees to locate and unlock any car with or without the owner's knowledge or permission.

Tesla, electric, hybrid cars at Frankfurt 2013 Motor Show

Experts eye Tesla to spur China's electric car market