Business & FinanceTop StoryTop StoryLatest News
Tata Motors' iRA Apps Exposed to Data Theft and User Impersonation: CERT-In
Sentiment: NeutralHigh Priority
What Happened?
CERT-In has identified multiple security vulnerabilities in Tata Motors' iRA 2.0 and iRA.ev applications, allowing potential data theft and user impersonation. Users are advised to upgrade to secure versions.
Key points
- CERT-In flagged vulnerabilities in iRA 2.0 version 26.7.3 and earlier, and iRA.ev version 26.7.2 and earlier.
- Four vulnerabilities identified include hardcoded credentials and inadequate URL validation.
- Attackers could exploit these vulnerabilities to access sensitive information and impersonate users.
- Users are advised to upgrade to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1.
- The applications provide access to connected vehicle services like remote commands and vehicle status.
Key insights
- Exploitation of these vulnerabilities could lead to unauthorized access to vehicle systems.
- Users of connected vehicles may need to be more vigilant about app security.
- Tata Motors may face reputational damage if these issues are not addressed promptly.
Why it matters
The vulnerabilities could compromise user data and vehicle security, affecting customer trust.
Tags
Entities
Tata Motors· CompanyCERT-In· Organization
Source
Business Standard
