Follow us on Google News
The Indian Computer Emergency Response Team has issued an advisory warning of multiple security vulnerabilities in Tata Motors’ connected vehicle mobile applications, iRA 2.0 and iRA.ev. In a vulnerability note issued on November 4, the national cyber security agency cautioned that these security flaws could be exploited by malicious actors to impersonate legitimate vehicle owners, harvest sensitive user credentials, and gain unauthorized access to vehicle data and remote telematics services. Tata Motors stated on November 5 that all identified issues have been remediated through software updates rolled out across August and September 2026.
CERT-In Warns of User Impersonation and Remote Exploitation
According to the CERT-In assessment, the detected vulnerabilities in the iRA and iRA.ev smartphone applications exposed critical communication pathways to potential exploitation. An attacker successfully leveraging these security gaps could extract sensitive login credentials or bypass authorization layers to access core telematics functions. The advisory noted that such breaches could allow adversaries to mimic genuine users and utilize connected services linked to the targeted vehicle without authorization.
The applications function as digital remote-control and monitoring hubs for modern connected vehicles, enabling owners to track real-time locations, monitor vehicle health metrics, and review fuel or battery charge levels. They also permit users to operate door locks and adjust cabin temperature settings remotely through mobile networks. The discovery of vulnerabilities within this digital architecture highlighted significant risks not only to personal user information but also to the misuse of remote vehicular operations.
Carmaker Confirms Security Patches Released in August and September
Responding to the advisory, Tata Motors issued a formal statement on November 5 clarifying that the vulnerabilities highlighted by the agency had already been identified and rectified. The automaker confirmed that protective security patches were developed and incorporated into updates released to vehicle owners during August and September 2026.
The company maintained that, based on internal security evaluations, customer data and related vehicle information remained secure throughout the process. While Tata Motors affirmed that all necessary measures were implemented to secure the platform, the advisory from CERT-In brought renewed scrutiny to the integrity and resilience of mobile software interfaces increasingly deployed across connected automobiles.
Rising Cybersecurity Challenges in Connected Vehicle Ecosystems
Mobile applications such as iRA 2.0 and iRA.ev connect modern automobiles to external internet and cellular networks, delivering convenience while introducing expanding attack surfaces. The convergence of live vehicle location tracking, driving diagnostics, and remote functional controls creates highly attractive targets for cyber criminals seeking unauthorized entry into automotive systems.
CERT-In emphasized that the capability to access sensitive credentials and commandeer vehicle functions underscores the need for robust software defenses. Emphasizing preventative digital hygiene, authorities noted that consumers must install the latest versions of the iRA and iRA.ev applications on their smartphones, warning that running outdated software builds could leave systems exposed to known security vulnerabilities.
