Tata Motors iRA apps have credential theft flaws
CERT-In rates four flaws in Tata Motors iRA 2.0 and iRA.ev apps as high severity allowing credential theft and owner impersonation.
50
Vulnerability1 · 1 read
CVE-2026-121146
Auth token exposure in Tata iRA 2.0 and iRA.ev mobile apps
- CVSS 4.0
- 6.8 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Authentication tokens are written to logs in the iRA 2.0 and iRA.ev mobile applications. A local attacker with log access can read the tokens and impersonate users. This grants unauthorized access to vehicle information and services on affected Tata Motors iRA devices.
What to do: Apply Tata Motors iRA update for CVE-2026-121146
| Product | Affected |
|---|---|
| Tata Motors iRA | 2.0 and iRA.ev |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session tokens. Successful exploitation of this vulnerability could allow the attacker to impersonate the associated user and gain unauthorized access to vehicle related information and services.
- Weakness
- CWE-532
- Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X