Security flaws in a carmaker’s web portal let one hacker remotely unlock cars from anywhere

Flaws in Car Maker’s Online Portal Exposed Customer Data and Vehicle Information

A recent discovery by security researcher Eaton Zveare revealed vulnerabilities in a major carmaker’s online dealership portal, potentially putting the private information and vehicle data of its customers at risk. Zveare, who works at software delivery company Harness, found a flaw that could have allowed hackers to remotely access and control customers’ vehicles.

Uncovering the Vulnerabilities

Zveare explained that the flaw he identified enabled the creation of an admin account with unrestricted access to the carmaker’s centralized web portal. This access could have been exploited by malicious actors to view personal and financial data, track vehicles, and even manipulate certain functions of the cars from anywhere.

While Zveare chose not to disclose the specific carmaker’s name, he did mention that it is a well-known automaker with multiple popular sub-brands. The discovery sheds light on the security risks associated with dealership systems that provide broad access to customer and vehicle information.

Addressing the Security Concerns

Zveare, who has previously uncovered vulnerabilities in carmakers’ customer systems and vehicle management platforms, stumbled upon this flaw during a weekend project earlier this year. Despite the challenge of identifying the security loopholes in the portal’s login system, Zveare managed to bypass the login mechanism by creating a new “national admin” account.

The buggy code loaded on the portal’s login page allowed Zveare to modify it and circumvent the security checks, granting him access to over 1,000 dealerships across the United States. This access provided insight into dealers’ financials, private data, and customer interactions, highlighting the extent of the security breach.

Exploiting System Weaknesses

One of the key findings within the dealership portal was a national consumer lookup tool that enabled users to retrieve vehicle and driver information. Zveare demonstrated the tool’s capabilities by identifying a car owner using only their first and last name or vehicle identification number.

Furthermore, Zveare confirmed that the portal allowed the pairing of vehicles with mobile accounts, granting users remote control over certain car functions. He tested this functionality with a friend’s consent, showcasing the ease with which ownership could be transferred using minimal verification.

Implications of the Vulnerabilities

Although Zveare did not test the ability to physically drive away with a vehicle, he highlighted the potential for thieves to exploit the vulnerabilities for theft or unauthorized access. Additionally, the interconnected nature of the carmaker’s dealer systems through single sign-on presented further security risks, allowing for user impersonation and unauthorized access to other dealer systems.

After disclosing the vulnerabilities to the carmaker, Zveare noted that the issues were promptly addressed within a week in February 2025. He emphasized the critical role of proper authentication protocols in safeguarding sensitive data and preventing unauthorized access.

Conclusion

Zveare’s discovery underscores the importance of robust cybersecurity measures in safeguarding customer data and vehicle information within dealership portals. By addressing vulnerabilities promptly and implementing secure authentication practices, carmakers can mitigate the risk of unauthorized access and protect customer privacy.