The Indian Computer Emergency Response Team (CERT-In) identified several high-severity vulnerabilities in specific versions of Tata Motors' connected vehicle applications, namely iRA 2.0 and iRA.ev, on Wednesday. The warning states that these flaws could lead to the disclosure of sensitive user credentials, impersonation capabilities, and unauthorized access to vehicle-related information and services.
The vulnerabilities affect iRA 2.0 versions below 26.7.3 and iRA.ev versions below 26.7.2. These applications are designed for Tata Motors customers using Internal Combustion Engine (ICE) vehicles and Electric Vehicles (EVs), respectively, providing access to connected features such as remote vehicle control, vehicle status information, health monitoring, and trip data.
CERT-In discovered four types of vulnerabilities related to hardcoded credentials, insufficient URL validation, leakage of authentication tokens in application logs, and improper implementation of SSL certificate pinning.
According to the notification, these shortcomings potentially allow attackers to extract credentials and gain access to backend services, as well as obtain authentication tokens to mimic user actions or intercept and modify communication between the applications and their backend systems.
The vulnerabilities found by CERT-In come amid growing global concerns about cybersecurity in connected cars. In recent years, security researchers have found flaws in connected car platforms operated by manufacturers such as Kia and Subaru, which could potentially expose customer information and allow unauthorized access to vehicle functions.
Furthermore, researchers have discovered vulnerabilities in Bluetooth software used in Mercedes-Benz, Volkswagen, and Skoda vehicles, which could potentially allow remote code execution through infotainment systems. These incidents highlight increasing security risks as automakers increasingly rely on mobile applications, cloud infrastructure, and connected services to provide digital features to vehicle owners.
