Connected cars: security flaws increasingly lie in apps and cloud services

Researchers at the University of Gothenburg and Chalmers University of Technology analysed 413 reported security vulnerabilities in automotive software from 2022 to 2024 and compared them with the previous decade. The study appeared in the Software Quality Journal, and the university presented it on 21 October. The result: the share of vulnerabilities in the apps, websites and cloud services around the car has nearly tripled, and these are more often rated serious or critical.

"We are surprised by how basic some of the weaknesses in these systems are," says software researcher Srijita Basu – such as unchanged factory passwords. The team identifies infotainment systems as a weak point: if they are not separated from vehicle controls, an attacker on the car's Wi-Fi could potentially reach other systems. Because one chip is often used in several manufacturers' models, a single flaw can also affect several brands.

As an example, the university cites a case from December 2024 in which data from around 800,000 electric cars of the VW group were openly accessible online for months because of a cloud service; the flaw was fixed before any misuse became known. According to the researchers, a reported vulnerability does not mean an attack took place, only that a risk exists.