The warning flags a risk of unauthorised access to sensitive information, user impersonation and unauthorised modification of application data. Impact Assessment: Potential for unauthorised access and modification of data with the privileges of the impersonated user.
New Delhi: The Indian Computer Emergency Response Team (CERT-In) on Wednesday flagged multiple vulnerabilities in select versions of Tata Motors’ iRA 2.0 and iRA.ev connected vehicle applications that could allow an attacker to get sensitive credentials or access vehicle-related information.
The severity rating for this vulnerability has been marked as “High”. Tata Motors iRA 2.0 versions 26.7.3 and below, and Tata Motors iRA.ev versions 26.7.2 and below are the impacted applications.
These applications allow customers to access connected vehicle features such as vehicle status, health monitoring, trip information and remote commands. CERT-In has advised users to upgrade to the latest iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1.
The warning flags a risk of unauthorised access to sensitive information, user impersonation and unauthorised modification of application data. Impact Assessment: Potential for unauthorised access and modification of data with the privileges of the impersonated user.
An e-mail sent to Tata Motors Passenger Vehicles remained unanswered.
CERT-In has flagged four vulnerabilities related to weaknesses in how the applications store credentials, handle web content and secure communications with backend systems.
The first involves hardcoded service account credentials, API keys and authorisation tokens within the app, which could be extracted and used to gain unauthorised access to backend services.
The second vulnerability arises from inadequate validation of URLs and origins loaded through the application’s WebView component. This could allow attackers to obtain authentication tokens and impersonate users.
The third one involves authentication tokens being recorded in application logs, which could be accessed and misused to gain access to user accounts.
The fourth relates to improper implementation of SSL certificate pinning in the network security configuration. This could potentially allow attackers to intercept or modify data exchanged between the application and its backend services.