Tata Motors' iRA App Flagged for Critical Data Security Vulnerabilities

The Indian Computer Emergency Response Team (CERT-In) has raised fresh concerns over the security posture of Tata Motors' iRA connected vehicle application, citing multiple critical vulnerabilities that threaten user privacy and data integrity. A risk assessment conducted by the federal cybersecurity agency identified potential pathways for unauthorised access to sensitive user information stored within the application infrastructure.

According to CERT-In's findings, the vulnerabilities extend beyond unauthorised data access, with researchers flagging the possibility of user impersonation—a scenario where threat actors could assume the identity of legitimate vehicle owners to perform unauthorised actions. The assessment also highlighted risks of unauthorised modification of application data, which could compromise the integrity of user accounts and vehicle-related information stored on Tata Motors' servers.

The iRA platform, which enables Tata Motors customers to remotely monitor and control vehicle functions through their smartphones, has emerged as a key digital touchpoint for the automotive manufacturer's connected car strategy. The security gaps identified by CERT-In underscore growing concerns about the robustness of cybersecurity measures embedded in automotive applications serving India's expanding smart vehicle ecosystem.

Tata Motors has not yet issued a public statement addressing the CERT-In findings or outlining remediation measures. Industry analysts emphasise that connected vehicle platforms handling personal and location data warrant rigorous security protocols to protect against evolving cyber threats. The development adds to a broader industry conversation about securing internet-connected automotive systems as vehicles increasingly incorporate digital and cloud-based technologies.