Tata Motors Passenger Vehicles addressed four high-severity vulnerabilities in its iRA 2.0 and iRA.ev connected vehicle apps flagged by CERT-In.
The flaws, including hardcoded credentials and token logging, were patched via mandatory over-the-air updates rolled out in August and September 2026.
Internal assessments confirmed no evidence of customer data compromise, vehicle access, or credential breaches.
Tata Motors Passenger Vehicles on Thursday said the company has addressed vulnerabilities identified in its iRA 2.0 and iRA.ev applications through software updates and enhanced security measures.
The vulnerabilities identified in the iRA 2.0 and iRA.ev applications have been addressed through software updates and enhanced security measures, a Tata Motors Passenger Vehicles spokesperson told PTI.
On Wednesday, the Indian Computer Emergency Response Team (CERT-In) flagged multiple vulnerabilities in select versions of Tata Motors' iRA 2.0 and iRA.ev connected vehicle applications. This could allow attackers to steal sensitive credentials, impersonate users, and gain unauthorised access to vehicle-related information and services, the central agency tasked with combating cybersecurity threats warned.
These applications are used by Tata Motors PV customers to access connected vehicle features such as vehicle status, health monitoring, trip information and remote commands.
CERT-In has marked the severity rating of the vulnerability in these applications - Tata Motors iRA 2.0 versions 26.7.3 and below, and Tata Motors iRA.ev versions 26.7.2 and below - as "High". It advised users to upgrade to the latest versions: iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1.
In line with CERT-In's advisory, mandatory updates to the latest versions – iRA 2.0 (version 26.8.2) and iRA.ev (version 26.9.1) – were rolled out in August and September 2026, respectively, the spokesperson said.
These updates are automatically prompted when users open the applications and can be completed over the air within a few minutes. The update rollout has been completed for all active users, and we are proactively reaching out to remaining customers who are yet to complete the updates to ensure their transition to the latest versions.
CERT-In flagged four vulnerabilities related to weaknesses in how the applications store credentials, handle web content and secure communications with back-end systems.
The spokesperson noted that the company's assessment indicates there is no evidence of any unauthorised access to or compromise of customer credentials, personal information or vehicle-related data, and customer data and vehicle-related information remain secure.
We continue to actively monitor our systems to maintain the security and protection of our customers, the spokesperson added.
