Is your Tata car at risk? Hackers may target iRA app, CERT-In warns

The Indian Computer Emergency Response Team (CERT-In) has identified four highly severe vulnerabilities in Tata Motors’ iRA 2.0 and iRA.ev apps. These flaws could allow a hacker to obtain sensitive data or impersonate the car owner. It can also let a hacker make changes to the app data without the authorisation from the owner.CERT-In issued the advisory on Wednesday. The agency identified iRA 2.0 versions 26.7.3 and earlier, and iRA.ev versions 26.7.2 and earlier, as the ones having the vulnerabilities.India Today Tech has reached out to Tata Motors for a comment. The story will be updated as and when the company responds.Which Tata cars are affected?Tata Motors’ iRA apps – iRA 2.0 and iRA.ev – are connected applications that are designed to bring smart features. That is, the flaws lie with the apps themselves and not the vehicles. Users can download both apps from the Google Play Store and Apple Appstore, and then connect it for smart features. This includes, remote vehicle commands, location and trip information, vehicle status and health monitoring, and fuel or battery details. iRA 2.0 is available for Tata’s internal combustion engine (ICE) vehicles, while iRA.ev is for electric vehicles (EVs). The iRA 2.0 app was first rolled out with the launch of the Tata Curvv in August 2024. Newer Tata ICE cars also work with this app, such as the Tata Sierra. Older models were slowly migrated from the original iRA app. The iRA.ev app was released with the Tata Curvv.ev, the same time as its ICE counterpart.You can check which version you are using by going to either the Play Store or the Apple Appstore depending on the device. CERT-In advises users to update the app to the latest version.What are the flaws in Tata’s iRA apps? According to the advisory, the first flaw involves the code of both apps. CERT-In stated that the code has embedded service account passwords and tokens. This could give the hacker the chance to access backend services and obtain sensitive information or perform “unauthorised operations” on the targeted system.The second vulnerability stems from insufficient validation of URLs within WebView. That is, iRA 2.0 and iRA.ev do not properly verify webpages before opening them inside the app. This could allow a hacker to send malicious links that may obtain user information.The third, CERT-In wrote, involves authentication tokens being recorded in logs used for development and debugging. A hacker with access to the logs could misuse exposed session tokens to gain access. The fourth flaw concerns the improper implementation of SSL certificate pinning, which could allow a hacker to intercept network traffic between the apps and backend services. CERT-In credited Pranav Rajendran for reporting the flaws.The advisory comes amid attacks on connected systems. Hackers recently raised supermarket refrigerator temperatures in Europe, while cyberattacks disrupted Toyota’s production in 2022 and Jaguar Land Rover’s operations in 2025. Researchers had also demonstrated in 2016 that about 100 million Volkswagen cars sold since 1995 could be unlocked remotely.At the same time, AI-assisted cyber incidents are growing. CERT-In has warned that a hacker group, designated as “Crafty Falcon,” is targeting banks and financial institutions using AI tools. Though the agency has been strengthening its own cybersecurity measures, including securing access to Anthropic’s restricted Claude Mythos.- Ends