Own a Tata car? CERT-In warns hackers could access vehicle data, connected services

India's cybersecurity agency CERT-In has flagged multiple high-severity vulnerabilities in Tata Motors' connected vehicle applications for internal combustion engine and electric vehicle customers, warning that attackers could gain access to sensitive credentials, vehicle-related information and connected services.

In a vulnerability note issued on November 4, CERT-In said the security flaws affect Tata Motors iRA 2.0 versions 26.7.3 and below, and iRA.ev versions 26.7.2 and below.

The applications allow customers to access connected vehicle services, including remote vehicle commands, vehicle status and health monitoring, and trip information.

“Multiple vulnerabilities have been reported in Tata Motors IRA and IRA.ev applications, which could allow an attacker to obtain sensitive credentials or access to vehicle related information and services,” CERT-In said.

The agency identified four security flaws, including hardcoded credentials, insecure application configuration, information disclosure and improper implementation of security controls.

The first vulnerability exists due to the presence of hardcoded service account credentials, API keys and authorisation tokens embedded in the application package.

An unauthenticated remote attacker could download the application package and extract the sensitive information to gain unauthorised access to associated backend services.

“Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to associated backend services and potentially access sensitive information or perform unauthorized operations on the targeted system,” the agency added.

Another vulnerability relates to insufficient validation of URLs and origins loaded through the applications' WebView component.

A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView.

CERT-In also flagged the exposure of authentication tokens in application logs used for development and debugging. An attacker with access to these logs could retrieve session tokens and use them to impersonate users.

The fourth vulnerability arises from improper implementation of SSL certificate pinning in the network security configuration, making the protection ineffective. An attacker positioned to intercept network traffic could potentially monitor or modify communications between the applications and backend services.

“An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services,” CERT-In said.

The agency advised users to upgrade to the latest versions of the applications, recommending iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1 to address the issues.