Loading story…
Researchers at Télécom SudParis reported that modern vehicle software platforms inherit large numbers of publicly documented vulnerabilities from upstream technologies including Linux, Android, QNX, and VxWorks, exposing weaknesses deep inside infotainment and automotive operating system stacks. Using a purpose-built scanner called VERA, the team analyzed automotive software images and found wide variation across platforms, including 1,203 documented vulnerabilities in the tested version of Automotive Grade Linux, while safety-certified systems such as QNX Neutrino and VxWorks 7 still contained dozens of known flaws listed in public vulnerability databases such as CVE and the EUVD.
The researchers said raw vulnerability totals do not automatically equate to practical compromise because exploitability depends on whether affected components are enabled, reachable, and shielded by platform-specific defenses. To test real-world impact, they developed two proof-of-concept attacks: one targeting SQLite on Android Automotive and another targeting SOME/IP communications, with the SOME/IP attack succeeding against Red Hat AutoSD and Tesla software but failing on Android Automotive. The study also found that general-purpose scanners such as Trivy generated many false positives in automotive environments, prompting the team to use VERA to produce a more actionable view of vehicle software risk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Help Net Security reported that Télécom SudParis researchers analyzed modern vehicle software stacks and found inherited vulnerabilities from Linux, Android, QNX, and VxWorks. The study introduced the VERA scanner and described proof-of-concept attacks against SQLite on Android Automotive and SOME/IP, with the SOME/IP attack succeeding on Red Hat AutoSD and Tesla software but failing on Android Automotive.
A CVE reference associated with this story was published on CVE.org. The provided content does not include technical details from the CVE entry itself.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcecve.org
Open sourcehakstuff.net
Open sourceeuvd.enisa.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers demonstrated **dozens of previously unknown vulnerabilities** during **Pwn2Own Automotive 2026** in Tokyo, including successful compromise of a **Tesla infotainment system** and multiple **EV chargers** and in-vehicle infotainment (IVI) products. On day one, researchers earned significant payouts after chaining bugs to achieve **root-level access** and code execution across targets; reported examples included a USB-based exploit chain against Tesla’s infotainment system to obtain root privileges, plus successful attacks against products from **Sony, Kenwood, Alpine**, and several EV charging vendors. Under the contest rules, affected vendors receive a **90-day window** to produce patches before Trend Micro’s **Zero Day Initiative (ZDI)** discloses the vulnerabilities. ZDI’s day-one results detail multiple winning exploit chains and vulnerability classes used against automotive-adjacent systems, including a **stack-based buffer overflow** yielding a root shell on an Alpine head unit, exploit chains against an **Autel** charger (including `CWE-306` and `CWE-347`) enabling charging-signal manipulation, a **hardcoded credential** (`CWE-798`) leveraged for code execution against the **Grizzl-E Smart 40A**, and a **command injection** used against the **ChargePoint Home Flex**. ZDI’s published schedule for subsequent days shows continued focus on the same target set (e.g., Kenwood DNR1007XR, Sony XAV-9500ES, Phoenix Contact CHARX SEC-3150, Alpitronic HYC50, and Grizzl-E Smart 40A), indicating additional attempts and potential further zero-day disclosures as the competition progresses.
Jun 29, 2026
Several critical vulnerabilities have been disclosed affecting a range of widely used software frameworks and hardware platforms. Notable issues include a critical flaw in the Apache bRPC framework (CVE-2025-59789) that exposes high-performance systems to crash risks, a high-severity unauthenticated XXE vulnerability in GeoServer (CVE-2025-58360) enabling file theft and SSRF, and a critical SQL injection vulnerability in Devolutions Server (CVE-2025-13757) that allows authenticated attackers to steal all stored passwords. Additional disclosures include a proof-of-concept exploit for a Windows Administrator Protection elevation of privilege vulnerability (CVE-2025-60718), a critical boot process compromise in Snapdragon 8 Gen 3 and 5G modems (CVE-2025-47372), and a flaw in Apache Kvrocks that allows privilege escalation via the 'RESET' command. A separate high-severity vulnerability (CVE-2025-61618) was identified in Unisoc T8100/T9100/T8200/T8300 chipsets, affecting Android devices and allowing remote denial of service through improper input validation in the NR modem. These vulnerabilities collectively highlight the ongoing risk posed by both software and hardware flaws, with several enabling remote code execution, privilege escalation, or denial of service. Organizations using affected products should prioritize patching and mitigation efforts to reduce exposure to these critical threats.
Jun 29, 2026
Innora Security Research disclosed 11 vulnerabilities across eight automotive CAN-related libraries and tools, including **Open-SAE-J1939**, `isotp-c`, `uds-c`, `socketcand`, `cannelloni`, `OpenAMP`, and `OVMS3`. The issues span integer underflow and overflow, stack and heap buffer overflows, and other out-of-bounds memory access conditions affecting software used in ECUs, CAN gateways, diagnostic tooling, industrial networks, and research platforms. The report said several flaws are reachable through crafted CAN frames, tunneled CAN traffic, malformed firmware images, or malicious log files, with many assigned **CVSS 9.8** severity due to the potential for remote memory corruption and service disruption. One of the newly tracked issues, **`CVE-2026-37537`**, affects `collin80/Open-SAE-J1939` through commit `744024d4306bc387857dfce439558336806acb06`. In the library's Transport Protocol Data Transfer handling, a CAN frame with `data[0] = 0` causes the calculation `uint8_t index = data[0] - 1` to underflow to `255`, leading to an out-of-bounds write past the allocated `MAX_TP_DT` buffer. The vulnerability was assigned **CVSS v3.1 `AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`**, indicating an adjacent-network attack path with high integrity and availability impact, and it underscores broader unsafe length handling and unchecked memory operations across the affected CAN software ecosystem.
Jun 29, 2026