At Security Analyst Summit 2025 in October, Kaspersky presented results of a security audit that exposed a significant security flaw enabling unauthorised access to all connected vehicles of one automotive manufacturer, said a press release.
Kaspersky researchers uncovered a critical security breach in a car manufacturer鈥檚 telematics system caused by a zero-day vulnerability in a contractor鈥檚 publicly accessible application.
Exploiting this flaw allowed remote control over connected vehicles, including dangerous actions such as forcing gear shifts or shutting off engines mid-drive, it said.
The breach originated from SQL injection vulnerability in the contractor鈥檚 wiki application, enabling access to user credentials and sensitive configuration data linked to the manufacturer鈥檚 telematics infrastructure.
Further investigation revealed a misconfigured firewall and weak credentials, granting full control over the telematics system and access to the vehicle鈥檚 Controller Area Network (CAN) bus鈥攎aking it possible to manipulate key vehicle functions.
鈥楾his breach demonstrates how a single weak link in a contractor鈥檚 infrastructure can cascade into a full compromise of all of the connected vehicles. The automotive industry must prioritize robust cybersecurity practices, especially for third-party systems, to protect drivers and maintain trust in connected vehicle technologies,鈥� commented Artem Zinenko, head of Kaspersky ICS CERT Vulnerability Research and Assessment.
