The Indian Computer Emergency Response Team (CERT-In) recently warned that Tata Motors' iRA 2.0 and iRA.ev connected vehicle apps contain four security flaws.
\n\nIt issued the warning as vulnerability note CIVN-2026-0537 and rated the severity "High". The agency said the flaws could let an attacker “obtain sensitive credentials or access to vehicle related information and services.”
\n\niRA 2.0 is meant for customers with petrol and diesel cars, while iRA.ev is for electric vehicle owners. The warning covers iRA 2.0 version 26.7.3 and below, and iRA.ev version 26.7.2 and below.
\n\nCERT-In has advised users to upgrade to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1. An e-mail sent to Tata Motors Passenger Vehicles remained unanswered.
\n\nThe apps turn a smartphone into a remote control for the car. Users can track its location, check vehicle health, trip details and fuel or battery status, and send remote commands such as locking doors or setting cabin climate.
\n\nThe first flaw, tracked as CVE-2026-121144, is that the app package holds hardcoded service account credentials, API keys and authorisation tokens. An unauthenticated remote attacker could download the package and extract this information to reach backend services and carry out “unauthorized operations” on the targeted system.
\n\nThe…
Original source: https://www.cnbctv18.com/technology/
