Overview
- CERT-In issued an advisory on Wednesday warning of four high-severity vulnerabilities in Tata Motors’ iRA 2.0 and iRA.ev mobile apps that could expose user credentials and session tokens.
- The advisory lists four specific technical faults: hardcoded service-account credentials and API keys inside the app, unsafe WebView URL/origin handling, authentication tokens being written to app logs, and improperly implemented SSL certificate pinning.
- The flaws affect iRA 2.0 versions 26.7.3 and earlier and iRA.ev versions 26.7.2 and earlier, and they relate to the mobile apps and their backend connections rather than vehicle firmware or in-car systems.
- Tata Motors says it released fixes earlier this year, that over-the-air updates were auto-prompted for active users, and that the company is contacting customers who have not yet updated.
- CERT-In and reporters advise users to check app stores and install iRA 2.0 version 26.8.2 or iRA.ev version 26.9.1 now because attackers who exploit these app-level flaws could access or modify vehicle-related services or impersonate owners.