"The vulnerabilities identified in the iRA 2.0 and iRA.ev [connected car tech] applications have been addressed through software updates and enhanced security measures," stated Tata Motors, after the Indian Computer Emergency Response Team (CERT-In) flagged app vulnerabilities on November 4. These applications provide access to vehicle related information and services such as remote vehicle features, car status and trip information.
CERT-In rated the severity of the vulnerabilities "High", and said that these "could allow an attacker to obtain sensitive credentials or access to vehicle related information and services". iRA 2.0 26.7.3 and below, and iRA.ev 26.7.2 and below were among the versions affected. Models like the Tata Curvv, Nexon, Harrier EV, Sierra EV and more feature the brand's connected car tech.
OTA updates rolled out in August, September
Tata Motors also stated that in line with CERT-In's advisory, mandatory updates to the latest versions - iRA 2.0 (26.8.2) and iRA.ev (26.9.1) - were rolled out in August and September 2026, respectively. These updates are automatically prompted when users open the respective applications and can be completed over the air (OTA).
"The update rollout has been completed for all active users, and we are proactively reaching out to remaining customers who are yet to complete the updates to ensure their transition to the latest versions," it added.
The carmaker assured that in its assessment, customer data and vehicle-related information remain secure, with no evidence of any unauthorised access to or compromise of customer credentials, personal information or vehicle-related data.
"We continue to actively monitor our systems to maintain the security and protection of our customers. Tata Motors takes the security and privacy of its customers extremely seriously. As part of our proactive cybersecurity practices, we continuously monitor our systems for potential vulnerabilities and work closely with CERT-In, sharing relevant findings transparently," it said.