Tata Motors iRA app contains hardcoded credentials
Original title: Hardcoded credentials and other issues in Tata Motors App
CERT-In reports flaws in Tata Motors connected vehicle apps that enable credential extraction and unauthorized access.
CERT-In disclosed multiple vulnerabilities in Tata Motors iRA 2.0 and iRA.ev mobile applications. Hardcoded service account credentials and insecure WebView configuration allow attackers to steal sensitive information and impersonate users.
- Hardcoded credentials in app package
- Insecure URL validation in WebView
- Affects iRA 2.0 versions 26.7.3 and below
- Affects iRA.ev versions 26.7.2 and below
Impact: unauthorized access to vehicle data
| Product | Affected |
|---|---|
| Tata Motors iRA 2.0 | 26.7.3 and below |
| Tata Motors iRA.ev | 26.7.2 and below |
- Vendors
- Tata Motors
- Organizations
- CERT-In
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-121144 | Hardcoded credentials in iRA 2.0 and iRA.ev mobile apps | 8.8 | — | ||
| CVE-2026-121145 | WebView URL validation in iRA 2.0 and iRA.ev apps | 7.1 | — |
From the original article
4 min read at cert-in.org.in[Accessibility Options](javascript:callSearch('AccessibiltyOptions')) Sitemap [Contact Us](javascript:callSearch('ContactUs')) [](javascript:callSearch('Home'))[](https://www. cert-in. org.
By qtqtqt · cert-in.org.in
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.