Critical Flaw in Carmaker's Portal Exposes Customer Data, Enables Remote Vehicle Access

Security researcher Eaton Zveare discovered a critical vulnerability in a major automaker's online dealership portal. The flaw allowed the creation of an admin account, granting access to sensitive data from over 1,000 dealerships. This included customer personal and financial information, vehicle tracking data, and the ability to remotely control vehicle functions. Exploiting a weakness in the login system, Zveare bypassed authentication and created a 'national admin' account. While patched in February 2025, the vulnerability highlights significant security risks in car dealership systems.