The Indian Computer Emergency Response Team (CERT-In) has issued a high-severity cybersecurity advisory warning of multiple critical vulnerabilities in select versions of Tata Motors’ connected vehicle applications, iRA 2.0 and iRA.ev. The national cybersecurity agency cautioned that these security flaws could be exploited by malicious actors to extract sensitive credentials, intercept private communications, impersonate legitimate users, access vehicle-related services, and modify internal application data without authorization. The affected software versions identified by CERT-In include Tata Motors iRA 2.0 version 26.7.3 and earlier, as well as iRA.ev version 26.7.2 and earlier, which service the company’s internal combustion engine and electric vehicle owners respectively. In its technical assessment, CERT-In outlined four primary security weaknesses embedded within the software architecture, starting with the presence of hardcoded service account credentials, API keys, and authorization tokens stored directly inside the application packages. This flaw allows unauthenticated remote attackers to easily extract sensitive keys by simply downloading the package, thereby obtaining unauthorized entry into associated backend infrastructure. The second flaw stems from insufficient validation of URLs and origins loaded within the apps’ WebView component, creating a loophole where attackers can feed malicious web content to steal live bearer authentication tokens and hijack user accounts. The third vulnerability involves the insecure recording of sensitive session authentication tokens within development and debugging logs, enabling local attackers with log access to harvest active tokens and assume control over connected vehicle functions. Lastly, CERT-In highlighted an improper implementation of SSL certificate pinning within the network security configuration, which leaves communications between the mobile application and backend servers vulnerable to man-in-the-middle interception and data tampering by network-level attackers. Given that these connected vehicle applications grant users remote control over essential features such as remote vehicle commands, real-time status updates, health monitoring, and trip diagnostics, successful exploitation poses severe operational and privacy risks to vehicle owners. To mitigate these threat vectors, CERT-In has urgently advised all affected vehicle owners to immediately update their software to iRA 2.0 version 26.8.2 or iRA.ev version 26.9.1, where the critical security patches have been fully deployed to restore system integrity.
Data Theft and User Impersonation Risks Exposed in Tata Motors Connected Car Apps
