GoKawiilCERT-In flags hardcoded credentials, insecure settings in Tata Motors iRA apps
CERT-In has issued a high-severity advisory for Tata Motors' iRA 2.0 (version 26.7.3 and below) and iRA.ev (version 26.7.2 and below) connected-vehicle apps. The flaws include hardcoded service account credentials, API keys and authorization tokens embedded in the app package, plus an insecure configuration issue, which together could let an unauthenticated attacker extract sensitive data and access backend vehicle services.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the apps control remote vehicle commands and health monitoring, exploitation could let attackers impersonate users or tamper with connected-car functions, according to CERT-In's risk assessment. The advisory underscores a recurring weakness in connected-vehicle software where credentials baked into mobile apps can be extracted and reused against cloud backends. Owners of affected Tata vehicles may need to watch for an app update addressing these issues.
- CERT-In rated the vulnerabilities in iRA 2.0 and iRA.ev apps as high severity.
- Hardcoded credentials and API keys embedded in the app package can be extracted by attackers without authentication.
- Exploitation could enable unauthorized access to backend services and vehicle-related data or commands.
Source: cert-in.org.in, 2026-11-06
Published there as: “Hardcoded credentials and other issues in Tata Motors App”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.