Tata Motors iRA app flaws could let attackers impersonate car owners
VULNERABILITYCERT-Inredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
CERT-In has rated four flaws in Tata Motors' iRA 2.0 and iRA.ev mobile apps as High severity. They cover embedded credentials, WebView token exposure, authentication tokens in logs and weak SSL certificate pinning, and could allow credential theft, owner impersonation and traffic interception. Researcher Pranav Rajendran is credited with reporting them, and CERT-In reports no active exploitation.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Update iRA 2.0 to version 26.8.2 or later.
- Update iRA.ev to version 26.9.1 or later.
- Check whether your customers or staff use these apps.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Government agencies