Overview
- CERT‑In published a high‑severity advisory that identifies four distinct flaws in Tata Motors’ iRA 2.0 and iRA.ev mobile apps that power features like location, vehicle health and remote commands.
- The advisory assigns four CVE identifiers—CVE‑2026‑121144 through CVE‑2026‑121147—linked to hardcoded service credentials, unsafe WebView URL/origin handling, authentication tokens recorded in logs, and improper SSL certificate pinning.
- CERT‑In said an attacker who exploits these flaws could extract backend credentials, obtain live bearer tokens to impersonate users, access vehicle data and possibly issue actions that run with the impersonated user’s privileges.
- The agency named affected releases (iRA 2.0 at or below v26.7.3 and iRA.ev at or below v26.7.2), recommended updating to iRA 2.0 v26.8.2 and iRA.ev v26.9.1, and credited researcher Pranav Rajendran for reporting the issues.
- Tata Motors had not responded to media queries as of the advisory’s publication and CERT‑In said there were no public reports of active exploitation; the notice joins broader industry concerns about vehicle‑link and supply‑chain cyber risks and faster vulnerability discovery driven by AI tools.