Archive — US — techcrunch
Security flaws in a carmaker’s web portal let one hacker remotely unlock carsfrom anywhere
A security researcher uncovered vulnerabilities in a major carmaker's web portal, allowing potential unauthorized access to customer data and vehicle control from anywhere. The flaws, linked to poor authentication, raised alarms about dealership system security, indicating they could let hackers remotely unlock cars and view sensitive information.
Key points
- A security researcher, Eaton Zveare, found vulnerabilities in a carmaker's web portal.
- The vulnerabilities allowed creation of an admin account, granting extensive access to customer and dealer data.
- The researcher demonstrated that it was possible to use a vehicle's VIN to access ownership details.
- Access to the portal could enable hackers to control vehicles remotely, such as unlocking them.
- The interconnected systems allowed jumping between dealer platforms, leading to broader exposures.
- Zveare reported the flaw in early 2025, and it took a week for the carmaker to address these security issues.
Why it matters
- This incident highlights ongoing concerns about cybersecurity in the automotive industry, particularly in connected vehicle technologies.
- As more cars integrate digital features, the need for robust security measures mirrors trends in 2025 focused on Internet of Things (IoT) security.
- This case aligns with increasing regulatory scrutiny on data protection and cybersecurity due to recent high-profile breaches across sectors.
The discovery of these security flaws underscores the urgent need for automakers to enhance their cybersecurity frameworks, especially as vehicles become increasingly interconnected and reliant on digital systems.