Carmaker Portal Flaw Could Let Hackers Unlock Cars, Steal Data

A security researcher discovered and disclosed an authentication flaw in a major automaker’s dealer portal that allowed creation of an elevated “national administrator” account, exposing thousands of customers’ personal and financial data, revealing real-time vehicle locations, and enabling remote actions such as unlocking cars using VINs or owner names; the vendor patched the issue about a week after disclosure.