CONNECT WITH US
Tech

Tech

Tata cars apps have security flaws that could let hackers impersonate owners: Indian cyber agency

CNBCTV18 - Tech logo

Published on

Add as a preferred source on Google
Tata cars apps have security flaws that could let hackers impersonate owners: Indian cyber agency

The Indian Computer Emergency Response Team (CERT-In) recently warned that Tata Motors' iRA 2.0 and iRA.ev connected vehicle apps contain four security flaws.

It issued the warning as vulnerability note CIVN-2026-0537 and rated the severity "High". The agency said the flaws could let an attacker “obtain sensitive credentials or access to vehicle related information and services.”

iRA 2.0 is meant for customers with petrol and diesel cars, while iRA.ev is for electric vehicle owners. The warning covers iRA 2.0 version 26.7.3 and below, and iRA.ev version 26.7.2 and below.

CERT-In has advised users to upgrade to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1. An e-mail sent to Tata Motors Passenger Vehicles remained unanswered.

The apps turn a smartphone into a remote control for the car. Users can track its location, check vehicle health, trip details and fuel or battery status, and send remote commands such as locking doors or setting cabin climate.

The first flaw, tracked as CVE-2026-121144, is that the app package holds hardcoded service account credentials, API keys and authorisation tokens. An unauthenticated remote attacker could download the package and extract this information to reach backend services and carry out “unauthorized operations” on the targeted system.

The second, CVE-2026-121145, is that the apps do not properly validate URLs and origins loaded in their WebView component. A remote attacker could send malicious web content to it, interact with app functions without permission and obtain live bearer authentication tokens. These could be used to impersonate the user.

The third, CVE-2026-121146, is that authentication tokens are recorded in application logs used for development and debugging.


Source link
Related Topics:Tech

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.