CERT-In warns of security vulnerabilities in Tata Motors' connected vehicle apps
India's Computer Emergency Response Team identified four critical vulnerabilities in Tata Motors' iRA 2.0 and iRA.ev connected vehicle applications affecting specific versions. The flaws included hardcoded credentials, inadequate URL validation, exposure of authentication tokens in logs, and weak SSL certificate pinning implementation. These vulnerabilities could allow attackers to extract credentials, impersonate users, or intercept vehicle communications. The applications serve both internal combustion and electric vehicle customers with features like remote commands, health monitoring and trip data access. The advisory reflects broader cybersecurity concerns facing connected vehicle platf
Key points
- Four high-severity vulnerabilities identified in iRA 2.0 and iRA.ev apps
- Flaws include hardcoded credentials, weak authentication, and certificate pinning issues
- Could enable user impersonation and unauthorized vehicle access
- Affects Tata Motors' ICE and EV customers with connected services
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. YourStory did the reporting; read the original for the full story.
Read the full story at YourStory
