CERT-In Vulnerability Note CIVN-2026-0537: Multiple Vulnerabilities in Tata Motors iRA and iRA.ev
Summary
CERT-In issued Vulnerability Note CIVN-2026-0537 detailing multiple vulnerabilities in Tata Motors iRA and iRA.ev mobile apps, including hardcoded credentials, insecure WebView origin validation, token logging, and SSL pinning misconfiguration. Upgrades to the latest versions (iRA 2.0: 26.8.2 and iRA.ev: 26.9.1) are recommended to mitigate these issues. The advisory highlights the risk of unauthorized access to backend data and vehicle-related information.