When a Cyber Incident Halts an Automaker: A Wake-Up Call for Supply Chain Security
We examine the Jaguar Land Rover cyber incident, emphasizing how the automotive industry can defend against similar supply chain attacks.
Vulnerabilities
CVE-2025-6019: A Privilege Escalation Flaw With Implications for AGL and the Future of SDVs
A recently disclosed Linux flaw shows how seemingly ordinary bugs are starting to affect software-defined vehicles (SDVs). We unpack CVE-2025-6019, its impact on Automotive Grade Linux (AGL), and what it means for in-vehicle cybersecurity.
Stop Wasting Hours on Manual Attack Path Identification — Let Automation Do the Heavy Lifting
Effective attack path identification enables automotive manufacturers and suppliers to stay ahead in an increasingly complex threat landscape. Learn how VicOne xZETA combines AI and curated automotive threat intelligence to streamline product security risk assessment, minimize manual efforts, and deliver actionable insights.
Playing Doom on an IVI System: More Alpine Halo9 Vulnerabilities From Pwn2Own Automotive 2024
We examine the NCC Group’s two-bug chain during Pwn2Own Automotive 2024, which enabled the team to play Doom on the Alpine Halo9 iLX-F509 IVI system. We underscore the more serious implications once attackers gain root access and recommend countermeasures to mitigate the risks.
Under Pressure: Exploring a Zero-Click RCE Vulnerability in Tesla’s TPMS
We examine a zero-click remote code execution (RCE) vulnerability in Tesla’s tire pressure monitoring system (TPMS), uncovered by Synacktiv researchers at Pwn2Own Vancouver 2024, and highlight its implications for connected vehicle security.
From Pwn2Own Automotive: A High-Severity Zero-Click RCE Bluetooth Vulnerability in the Alpine Halo9 IVI System
The Pwn2Own Automotive 2024 competition uncovered a high-severity zero-click RCE Bluetooth vulnerability in the Alpine Halo9 IVI system, highlighting the risks of proprietary implementations in connected vehicles. We explore the discovery, exploitation techniques, and key takeaways for securing automotive technologies against emerging threats.
Security Mitigations for the Multiple Zero-Day Vulnerabilities Discovered in an IVI System
The ZDI has identified six zero-day vulnerabilities in an in-vehicle infotainment (IVI) system. As these vulnerabilities remain unpatched, we recommend security best practices to minimize their potential risks and fortify connected vehicles’ IVI systems.
Exploiting the Emporia EV Charger: A Hacker’s Point of View
Exposed serial interfaces in electric vehicle (EV) chargers present a significant vulnerability, enabling attackers to tamper with hardware and firmware. This creates opportunities for malicious activities, highlighting the need for strong security measures to prevent such exploits.
Breaking Into Tesla’s IVI System: Synacktiv’s Two-Bug Exploit Chain at Pwn2Own Automotive 2024
We take a look at Synacktiv’s two-bug chain that successfully exploited Tesla’s in-vehicle infotainment (IVI) system at Pwn2Own Automotive 2024, highlighting security takeaways for enhancing automotive cybersecurity.
From Pwn2Own Automotive: More Stack-Based Buffer Overflow Vulnerabilities in Autel MaxiCharger
We examine two more Autel MaxiCharger vulnerabilities discovered at Pwn2Own Automotive 2024: CVE-2024-23967 and CVE-2024-23957. Both are classified as a stack-based buffer overflow, a classic yet avoidable programming error that could lead to remote code execution.
From Pwn2Own Automotive: A Stack-Based Buffer Overflow Vulnerability in JuiceBox 40 Smart EV Charging Station
We examine CVE-2024-23938, a JuiceBox 40 smart EV charging station vulnerability discovered at Pwn2Own Automotive, and discuss its broader implications for the automotive industry.