CERT-In warns of security vulnerabilities in Tata Motors' connected vehicle apps

The Indian Computer Emergency Response Team (CERT-In) on Wednesday flagged multiple high-severity vulnerabilities in specific versions of Tata Motors' iRA 2.0 and iRA.ev connected vehicle applications, warning that they could expose sensitive user credentials, enable user impersonation and allow unauthorised access to vehicle-related information and services.

The vulnerabilities affect iRA 2.0 versions 26.7.3 and below, and iRA.ev versions 26.7.2 and below. The applications cater to Tata Motors' internal combustion engine (ICE) and electric vehicle (EV) customers, respectively, and provide access to connected services such as remote vehicle commands, vehicle status, health monitoring and trip information.

CERT-In identified four vulnerabilities involving hardcoded credentials, inadequate URL validation, exposure of authentication tokens in application logs and improper implementation of SSL certificate pinning.

According to the advisory, these flaws could allow attackers to extract credentials and access backend services, obtain authentication tokens to impersonate users, or intercept and modify communications between the applications and their backend systems.

The vulnerabilities flagged by CERT-In come amid growing cybersecurity concerns around connected vehicles globally. In recent years, security researchers have identified flaws in connected-car platforms operated by automakers such as Kia and Subaru that could potentially expose customer information and enable unauthorised access to vehicle functions.

In another instance, researchers discovered vulnerabilities in Bluetooth software used in vehicles manufactured by Mercedes-Benz, Volkswagen, and Skoda, which could potentially allow remote code execution through infotainment systems. These incidents highlight the growing security risks as automakers increasingly rely on mobile applications, cloud infrastructure and connected services to offer digital features to vehicle owners.