Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView.

Successful exploitation of this vulnerability could allow the attacker to perform unauthorized interaction with application functionality, obtain live bearer authentication tokens and potentially impersonate the associated user and access vehicle related information and services.

Üreticinin çözüm notu (İngilizce)

Upgrade to latest versions:

Tata Motors iRA 2.0 to version 26.8.2

Tata Motors iRA.ev to version 26.9.1

Etkilenen sürümler2 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• cert-in.org.in/s2cMainServlet Üçüncü taraf

Kayıt geçmişi

1. 4 Kas 2026 15:34Yayımlandı

İlgili açıklar

• 8,5 CVE-2026-121147Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application
• 6,8 CVE-2026-121146Information Disclosure Vulnerability in Tata Motors iRA and iRA.ev mobile application
• 8,8 CVE-2026-121144Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile application
• 8,3 CVE-2026-92704SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution
• 6,5 CVE-2026-114456Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers
• 9,1 CVE-2026-121802better-auth/expo: Doğrulanmamış state değeri nedeniyle hesap ele geçirme riski