CERT-In rates Tata Motors iRA connected car apps High severity over credential and impersonation risks

India's Computer Emergency Response Team (CERT-In) has flagged multiple high severity vulnerabilities in older versions of Tata Motors' iRA 2.0 and iRA.ev connected vehicle apps. Business Standard, citing the advisory, said the affected builds are iRA 2.0 version 26.7.3 and earlier and iRA.ev version 26.7.2 and earlier. YourStory carried the same version numbers and severity. The apps let ICE and EV owners use remote commands, vehicle status, health monitoring and trip information.

CERT-In described four issues: hardcoded service account credentials, API keys and authorisation tokens inside the app package; weak validation of URLs and origins loaded in WebView; authentication tokens written into development and debug logs; and improper SSL certificate pinning. Business Standard summarised the risks as credential theft, user impersonation and unauthorised changes to application data, including access to vehicle related services if an attacker obtains live tokens.

CERT-In advised users to upgrade to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1. A Tata Motors Passenger Vehicles spokesperson told Business Standard the company found no evidence of unauthorised access to customer credentials, personal information or vehicle related data, and that mandatory updates rolled out in August and September 2026 with over the air prompts. YourStory quoted a matching company line that active users had been updated and remaining customers were being chased to finish the upgrade.

The advisory lands while CERT-In is also warning banks and fintechs about AI assisted API abuse. Connected car apps sit at the same junction of consumer identity, remote control and cloud backends, so version lag becomes a security problem the moment an old build stays on a phone. Owners who still see older version numbers should update before treating remote lock or status features as routine.