CERT-In warns of security vulnerabilities in Tata Motors' connected vehicle apps

CERT-In found multiple high-severity vulnerabilities in Tata Motors’ connected vehicle apps. The affected products were iRA 2.0 for internal combustion engine customers and iRA.ev for electric vehicle customers. These apps support remote commands, vehicle status, health monitoring and trip information. That made the weaknesses important beyond an ordinary mobile-app defect.

The affected versions were iRA 2.0 version 26.7.3 and below, and iRA.ev version 26.7.2 and below. CERT-In said the flaws could expose sensitive credentials, enable user impersonation and allow unauthorised access to vehicle-related information and services.

Tata Motors said the issues were fixed through software updates and stronger security measures. The latest iRA 2.0 version is 26.8.2, while iRA.ev is 26.9.1. The company said these updates were rolled out in August and September 2026, and that the rollout was completed for active users.

A connected vehicle app is software that gives an owner digital access to vehicle-related services. In Tata Motors’ case, iRA 2.0 serves internal combustion engine customers, while iRA.ev serves electric vehicle customers. These apps connect users with services that depend on the vehicle and its backend systems.

For example, an owner can use the apps for remote vehicle commands, check the vehicle’s current status, review health information and access trip details. The apps therefore handle more than basic account information. They also act as a gateway to services associated with the vehicle itself.

This convenience creates a security responsibility. If credentials, authentication tokens or communications are not properly protected, attackers may reach backend services or impersonate users. CERT-In’s warning shows why connected features need strong protections across the mobile app, its logs, network communications and backend systems.

CERT-In identified four vulnerabilities in the affected Tata Motors applications. The weaknesses involved different parts of app security, including stored credentials, web-address checking, logging and protection of encrypted connections. Their variety matters because attackers could potentially use more than one route to reach protected services or information.

The specific issues were hardcoded credentials, inadequate URL validation, exposure of authentication tokens in application logs and improper implementation of SSL certificate pinning. These are separate security weaknesses, but they can affect the same trust chain between an app, its user and backend systems.

The advisory said the flaws could let attackers extract credentials, obtain tokens, impersonate users or intercept and modify communications. Tata Motors said it addressed the vulnerabilities through software updates and enhanced security measures in iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1.

Credentials and authentication tokens are proof that an app or user is allowed to use a service. If attackers extract them, they may not need to break into an account through the normal login process. They could present the stolen information to backend systems as if they were an authorised user or application.

CERT-In said the vulnerabilities could allow attackers to extract credentials and access backend services. It also said exposed authentication tokens could be used to impersonate users. Inadequate protections could additionally let attackers reach vehicle-related information and services, including data connected with vehicle status, health monitoring or trips.

The advisory also warned that communications between the apps and backend systems could be intercepted and modified. Tata Motors said it found no evidence of unauthorised access or compromise of customer credentials, personal information or vehicle-related data. It said the affected flaws were fixed in later app versions.

CERT-In is the organisation that identified and publicly warned about the vulnerabilities in this case. Its advisory described the affected app versions, the four security weaknesses and the possible consequences, including credential theft, user impersonation and communication tampering. This gives users and the company a clear account of the risk.

Tata Motors was responsible for responding to the findings in its products. The company said it addressed the vulnerabilities with software updates and enhanced security measures. It released iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1, and said the rollout was completed for active users.

Tata Motors also said it was contacting remaining customers who had not completed the updates. It reported no evidence of unauthorised access or compromise of customer data. The company said it continues to monitor its systems, while CERT-In’s warning highlights why disclosure and remediation must work together.

Software updates replace vulnerable app code with corrected code and stronger protections. They are the direct remedy Tata Motors used for the affected versions. Secure logging matters because application logs can accidentally store authentication tokens; limiting or protecting sensitive log data reduces the chance that those tokens can be recovered.

URL validation checks whether an app is communicating with an approved destination. This can help prevent requests from being sent to a malicious or unintended address. SSL certificate pinning adds another check to encrypted connections by verifying that the service presents an expected certificate. When implemented properly, it makes interception or modification of app-to-backend traffic harder.

These measures address different weaknesses rather than solving the same problem. Tata Motors said the latest iRA 2.0 and iRA.ev versions included software updates and enhanced security measures. The article does not detail each individual fix, so the exact implementation is not specified.

Traditional cars generally rely less on mobile apps, cloud infrastructure and continuously connected services. Connected vehicles add those digital links so owners can use features such as remote commands, vehicle status, health monitoring and trip information. Each link creates another system that must be protected.

The Tata case shows the mechanism. A weakness in a mobile app could expose credentials or authentication tokens, let an attacker impersonate a user, or enable interception of communications with backend systems. The article also notes that researchers have found connected-car flaws involving Kia and Subaru platforms, and Bluetooth software in Mercedes-Benz, Volkswagen and Skoda vehicles.

This broader digital ecosystem increases the consequences of security mistakes. The article says concerns are growing globally as automakers rely more on apps, cloud infrastructure and connected services. It does not claim that every connected vehicle is compromised, but it shows why security must cover the whole service chain.