Overview

• In February, Eaton Zveare found client-side login and API vulnerabilities that allowed creation of a privileged national admin account in an unnamed automaker’s dealer portal.
• The compromised portal granted access to over 1,000 U.S. dealerships and exposed customer personal data, financial records, and telematics systems for real-time vehicle tracking.
• Zveare demonstrated that his admin account could pair vehicles to a mobile app, enabling remote unlocking, engine start, and location monitoring.
• The automaker patched the reported flaws within a week of the researcher’s disclosure and confirmed no evidence of prior exploitation.
• Public disclosure at DEF CON has shone a light on systemic risks in interconnected dealer-manufacturer platforms and spurred calls for stronger API and authentication controls.