Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services.

Üreticinin çözüm notu (İngilizce)

Upgrade to latest versions:

Tata Motors iRA 2.0 to version 26.8.2

Tata Motors iRA.ev to version 26.9.1

Etkilenen sürümler2 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• cert-in.org.in/s2cMainServlet Üçüncü taraf

Kayıt geçmişi

1. 4 Kas 2026 15:43Yayımlandı

İlgili açıklar

• 6,8 CVE-2026-121146Information Disclosure Vulnerability in Tata Motors iRA and iRA.ev mobile application
• 7,1 CVE-2026-121145Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application
• 8,8 CVE-2026-121144Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile application
• 9,1 CVE-2026-121638WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks
• 7,4 CVE-2026-121565Tanium ürünlerinde sertifika doğrulama hatası (CWE-295)
• 6,8 CVE-2026-121624Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation