Tata Motors iRA app vulnerabilities could expose sensitive credentials, vehicle-related information and connected-car services, according to a high-severity advisory issued by the Indian Computer Emergency Response Team (CERT-In) on Tuesday. The advisory covers select versions of Tata Motors’ iRA 2.0 and iRA.ev applications and warns that attackers could impersonate users or modify application data without authorisation.
The affected versions are iRA 2.0 version 26.7.3 and earlier, and iRA.ev version 26.7.2 and earlier. CERT-In has advised users to upgrade to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1 to address the vulnerabilities.
The applications are used by Tata Motors customers with internal combustion engine and electric vehicles. Their connected-vehicle features include remote vehicle commands, vehicle status, vehicle health monitoring and trip information. CERT-In said successful exploitation could allow attackers to access or modify data using the privileges of an impersonated user.
The advisory identifies four separate security weaknesses in the applications. The first involves hardcoded credentials, including service account credentials, application programming interface keys and authorisation tokens within the application package. CERT-In said an unauthenticated remote attacker could download the package and extract the information to gain access to associated backend services. This could expose sensitive information or enable unauthorised operations.
The second vulnerability concerns inadequate validation of URLs and origins loaded through the applications’ WebView component. According to CERT-In, an attacker could send malicious web content to the affected WebView and potentially obtain live bearer authentication tokens. Those tokens could then be used to impersonate users and access vehicle-related information and services.
The third issue relates to authentication tokens being recorded in application logs used for development and debugging. CERT-In said a local attacker with access to these logs could retrieve and misuse exposed session tokens, allowing unauthorised access to vehicle-related information and services.
The fourth vulnerability involves the implementation of SSL certificate pinning in the applications’ network security configuration. CERT-In said the improper implementation could allow an attacker positioned to intercept network traffic to intercept or modify communications between the applications and their backend services.
The advisory places the vulnerabilities in the connected-vehicle application layer rather than identifying a defect in the vehicles themselves. However, because the apps provide digital access to remote commands, status information and trip data, the security of the software and its backend communications is directly linked to how owners use connected-car features.
CERT-In’s upgrade recommendation provides the immediate mitigation identified in the advisory: users of the affected versions should move to iRA 2.0 version 26.8.2 or iRA.ev version 26.9.1. The supplied advisory does not state how many users or vehicles are affected, whether the vulnerabilities have been exploited, or whether any customer data was accessed. It also does not provide a separate timeline for remediation beyond the specified software updates.
