The Indian Computer Emergency Response Team has issued a high severity warning regarding critical security vulnerabilities discovered in Tata Motors’ connected vehicle applications. According to the advisory, the iRA 2.0 and iRA.ev apps contain flaws that could allow malicious actors to access sensitive user credentials and vehicle information. Owners of Tata vehicles are strongly encouraged to update their mobile applications to the latest versions to protect against potential unauthorized access to digital services.
Critical Vulnerabilities Identified in Tata Motors Apps: The Indian Computer Emergency Response Team, the national agency for cyber security, has flagged four distinct security weaknesses within Tata Motors’ connected car ecosystem. These vulnerabilities specifically affect the iRA 2.0 application, used for internal combustion engine vehicles, and the iRA.ev application, designed for the company’s electric vehicle lineup. The agency noted that these flaws could be exploited by attackers to impersonate legitimate users, gain access to sensitive data, and perform unauthorized operations within the app. While the mechanical integrity of the vehicles remains unaffected, the digital gateway provided by these apps presents a significant security risk if left unpatched. The warning has been categorized as high severity due to the sensitive nature of the data and the control features accessible through these platforms.
Affected Versions and Essential Software Updates: In an advisory dated November 4, 2026, CERT In specified the exact versions of the software that are vulnerable to these security threats. For the iRA 2.0 application, version 26.7.3 and all prior versions have been identified as having these weaknesses. Similarly, for the iRA.ev application, version 26.7.2 and older versions are susceptible to the identified flaws. The government agency has urged consumers to verify the version of the app currently installed on their smartphones. Updating to a newer, secure version is the primary recommendation to mitigate these risks. These updates are designed to close the security gaps and ensure that the communication between the user’s device and the corporate servers remains encrypted and protected from external interference.
Technical Breakdown of the Four Security Flaws: The investigation by CERT In revealed four specific areas where the applications’ security was found wanting. The first issue involves the insecure storage of critical digital information within the app itself. This includes login credentials for service accounts, API keys, and authorization tokens. If an attacker manages to extract these keys, they could potentially gain illegal access to the company’s backend services. The second flaw is related to the WebView feature, which allows the app to display web content. The agency found that the app did not exercise sufficient caution in validating the source of the web content being loaded. This lack of validation could be exploited to deliver malicious content to the user and steal live authentication tokens, which act as digital passes for verified users.
Concerns Regarding Application Logs and SSL Pinning: The third vulnerability identified by the cyber security agency pertains to the application’s logging mechanism. During development and testing, certain activities are recorded in logs: however, it was discovered that sensitive authentication tokens were also being recorded in these logs. If an unauthorized person gains access to these logs, they could use the tokens to assume the identity of the actual user. The fourth flaw involves the improper implementation of SSL Certificate Pinning. This security measure is intended to ensure that the app only connects to trusted and verified servers. CERT In found that this system was not correctly applied, creating a situation where an attacker capable of intercepting network traffic could read or even modify the communication between the app and the server.
Impact on App Functionality and Potential Risks: The iRA suite of applications serves as a comprehensive remote interface for Tata vehicle owners. Through these apps, users can track the real time location of their cars, monitor vehicle health, and review detailed trip histories. For electric vehicle owners, the app provides critical data on battery health and charging status. Additionally, the apps allow users to send remote commands, such as locking or unlocking the vehicle doors. While the CERT In advisory highlights these potential risks, it is important to note that there have been no confirmed reports of vehicles being hijacked or customer data being stolen due to these flaws. The warning serves as a proactive measure to inform the public about potential risks, emphasizing that the primary danger lies in the unauthorized access to digital services and sensitive vehicle data rather than the physical control of a moving car.
