Connected Vehicle Security

CERT-In flags hardcoded credentials, insecure settings in Tata Motors iRA apps

CERT-In has issued a high-severity advisory for Tata Motors' iRA 2.0 (version 26.7.3 and below) and iRA.ev (version 26.7.2 and below) connected-vehicle apps. The flaws include hardcoded service account credentials, API keys and authorization tokens embedded in the app package, plus an insecure configuration issue, which together could let an unauthenticated attacker extract sensitive data and access backend vehicle services.

cert-in.org.in · 2026-11-06

US Auto Industry Group Urges Congress to Ban Chinese-Made Vehicles and Software

The Alliance for Automotive Innovation, representing major automakers, has formally asked Congress to permanently ban the sale, import and manufacture of Chinese-made cars, parts and software. CEO John Bozzella cited concerns over unfair trade practices, subsidies, IP theft and surveillance, urging lawmakers to act before the current session ends. The request aligns with existing bipartisan legislation, the Connected Vehicle Security Act of 2026, targeting vehicle tech tied to China, Russia, Iran and North Korea.

cnet.com · 2026-09-05