CERT-In Warns of Critical Security Flaws in Tata Motors Connected Apps

5 Nov 2026, 2:50 pm · 2h ago · 1 min read · YourStoryNew

The Indian Computer Emergency Response Team (CERT-In) has flagged multiple high-severity security vulnerabilities in Tata Motors' iRA 2.0 and iRA.ev connected vehicle applications. The flaws affect iRA 2.0 versions up to 26.7.3 and iRA.ev versions up to 26.7.2, which control internal combustion and electric vehicle features. CERT-In identified four vulnerabilities involving hardcoded credentials, weak URL validation, exposed authentication tokens in logs, and improper SSL pinning. These issues could allow attackers to extract credentials, impersonate users, intercept data, and access vehicle backend services and commands without authorisation.