GoKawiilCERT-In flags hardcoded credentials, insecure settings in Tata Motors iRA apps
CERT-In has issued a high-severity advisory for Tata Motors' iRA 2.0 (version 26.7.3 and below) and iRA.ev (version 26.7.2 and below) connected-vehicle apps. The flaws include hardcoded service account credentials, API keys and authorization tokens embedded in the app package, plus an insecure configuration issue, which together could let an unauthenticated attacker extract sensitive data and access backend vehicle services.