Exploiting Volvo/Eicher’s fleet management platform to gain control over all users and vehicles
Summary
The article discloses a security vulnerability in VE Commercial Vehicles' My Eicher fleet management platform, exposing unauthenticated internal APIs, enabling potential account takeover and access to thousands of user accounts and vehicles. It outlines the sensitive data exposure (OTP histories, IDs) and provides a timeline of disclosure and partial remediation.