The Shifting Battleground: How Car Software Vulnerabilities Are Moving Beyond the Vehicle

Gothenburg, Sweden – A groundbreaking study from the University of Gothenburg has revealed a significant shift in the landscape of automotive cybersecurity. For years, concerns about vehicle vulnerabilities primarily focused on the car’s internal systems. However, recent research indicates that the most pressing security risks are now migrating to the interconnected ecosystem surrounding our vehicles, specifically within the apps, websites, and cloud services that manage them.

Published in the September 2026 issue of the Software Quality Journal, the study, conducted by researchers at the University of Gothenburg, meticulously analyzed security vulnerabilities identified between January 2022 and September 2024. This analysis was augmented by scans of selected open-source software projects, painting a clear picture of publicly documented security issues.

"A decade ago, the majority of security loopholes were discovered within the vehicle’s own systems," explains Srijita Basu, a postdoctoral researcher in software engineering at the University of Gothenburg and Chalmers University of Technology. "Now, the proportion of security vulnerabilities found in apps, websites, and cloud services has nearly tripled. These systems store sensitive data about our whereabouts, our driving routes, and our schedules. The risk, therefore, extends beyond potential manipulation of the vehicle itself; it encompasses the possibility of unauthorized access to intimate details about the lives of its occupants."

This migration of vulnerabilities presents a complex challenge for both manufacturers and consumers, demanding a proactive and holistic approach to cybersecurity in the automotive sector.

The Cloud as a Double-Edged Sword: Remote Control and Data Exposure

The research highlights a particularly critical area: services responsible for managing vehicle data and relaying commands remotely. A stark example of this emerged in 2024 when a team led by Sam Curry identified vulnerabilities within Kia’s dealer infrastructure. This allowed them to gain unauthorized access to connected vehicle functions. In equipped vehicles, they demonstrated the ability to track, unlock, and even remotely start the cars, as well as retrieve personal data. While these reported vulnerabilities were subsequently patched, the incident underscored the tangible risks to privacy and access control.

It is crucial to distinguish this type of vulnerability from direct remote control of driving functions. Unlocking and remote starting fall into a different technical category than manipulating braking pressure or steering. A comprehensive security assessment must meticulously define which commands a compromised platform can actually initiate.

"The Kia incident served as a potent reminder that the conveniences of connected car technology come with inherent security risks," notes Dr. Anya Sharma, a cybersecurity analyst specializing in automotive systems. "While the focus was on remote start and unlock, the underlying issue is the potential for unauthorized access to a vehicle’s digital identity and its associated data. This can have far-reaching implications for both physical security and personal privacy."

The Authentication Conundrum: Permissions Falling Short

A fundamental problem plaguing these connected services is the inadequacy of authorization checks. While users are required to log in, this often amounts to mere identity verification. The critical question of whether an individual is genuinely permitted to access a specific vehicle and execute a desired function often remains unanswered. As the Open Worldwide Application Security Project (OWASP) aptly states, "A transmitted Vehicle Identification Number (VIN) does not replace an access rights check."

Manufacturers are thus faced with the imperative to evolve their software development practices. Every sensitive request necessitates a server-side verification that confirms not only the user’s identity but also the vehicle to which their account is linked and the specific actions they are authorized to perform.

"The current approach often treats authenticated users as inherently trustworthy for all actions associated with their account," explains Dr. Sharma. "This is a flawed assumption. Just because you own a car and have an app for it doesn’t mean you should be able to remotely trigger any function at any time. Robust authorization frameworks are essential to prevent the escalation of privileges from a compromised account."

Centralized Platforms: A Single Point of Failure

Encrypted connections, while vital for data transport, do not inherently solve the core problem. They secure the communication channel but do not prevent unauthorized commands from being erroneously accepted by the server. These types of errors can have particularly widespread consequences when a single, centralized platform controls a large fleet of vehicles.

"Centralized platforms offer immense efficiency and scalability, but they also concentrate risk," states Professor Erik Johansson, a lead researcher on the Gothenburg study. "If a vulnerability exists within such a platform, it can potentially impact thousands, if not millions, of vehicles simultaneously. This makes the security of these central hubs paramount."

Direct Interfaces: Bluetooth as a Potential Entry Point

Beyond cloud services, directly accessible wireless interfaces can also pose significant risks. The 2025 publication of "PerfektBlue," detailing vulnerabilities in OpenSynergy’s Bluetooth software BlueSDK, serves as a case in point. A research team from PCA Cyber Security identified four combinable security flaws within this widely deployed software.

It’s important to contextualize Bluetooth attacks. They typically require proximity and, depending on the implementation, can involve interaction during the pairing process. Furthermore, a successful Bluetooth exploit commonly targets the infotainment system, not the core driving controls. PCA also highlighted supply chain challenges: even after the software provider released fixes, it reportedly took a considerable time for all affected manufacturers to implement the changes.

"The PerfektBlue findings demonstrate that even seemingly innocuous interfaces like Bluetooth can be exploited to gain a foothold into a vehicle’s digital architecture," notes Dr. Sharma. "The delay in patching across the supply chain is a persistent issue. Manufacturers need to have robust processes in place to ensure that security updates are disseminated and implemented rapidly across all their models and regions."

The Interconnected Threat: When Infotainment Meets Driving Control

The potential danger of a cascading attack chain was vividly demonstrated in 2015 by Charlie Miller and Chris Valasek. They gained remote access to a 2014 Jeep Cherokee via its connected Uconnect system, enabling them to interfere with physical vehicle functions. This was made possible by the confluence of multiple vulnerabilities: the system was externally accessible, and it was interconnected with the vehicle’s internal networks, which controlled critical components.

While security awareness has grown since then, this incident underscores the necessity for manufacturers to rigorously explore all potential attack vectors. Which interfaces are accessible? What privileges can an attacker gain there? Which other components can then be leveraged? Only through such comprehensive analysis can the true extent of potential damage be understood, even if a vulnerability initially appears minor.

Building Technical Fortifications: Segmenting Critical Systems

Since 2022, the U.S. National Highway Traffic Safety Administration (NHTSA) has recommended segmenting wirelessly connected control units from safety-critical functions. This includes braking, steering, propulsion, and power supply systems. The crucial principle is that compromising an infotainment system should not have far-reaching consequences. Communication channels with other components must be technically limited.

At the interfaces between these segments, secured gateway units should only forward explicitly authorized messages. This technical separation does not necessarily mean severing all connections; for instance, the infotainment system can display vehicle status information. However, this display function should not grant a general right to send control commands to arbitrary components.

"The concept of ‘defense in depth’ is critical here," says Professor Johansson. "By creating strong architectural boundaries between different vehicle systems, we can contain the impact of a breach. If an attacker compromises the infotainment system, they should be unable to leverage that access to control the brakes or steering. This requires careful design and rigorous testing of all inter-system communications."

Escalating Risks with Autonomous Driving

As vehicle automation advances, so too does the responsibility of vehicle software manufacturers. In a Level 2 driver assistance system, the human driver continuously monitors the traffic. In contrast, a Level 4 autonomous system takes over the driving task within its defined operational domain without human supervision. Consequently, in the event of a driving control attack, there can be no expectation of human intervention to correct the situation.

"The progression to higher levels of automation, particularly Level 4 and beyond, fundamentally changes the threat model," explains Dr. Sharma. "In a fully autonomous vehicle, the software is the driver. Any compromise of the driving control systems becomes a direct threat to passenger safety, with no human fallback. This necessitates an even higher bar for cybersecurity resilience."

The Double-Edged Sword of Security Updates

While software updates are designed to patch known vulnerabilities, they also introduce a security-critical transmission pathway. The Uptane framework, developed for vehicle updates, outlines necessary checks for software packages and their associated metadata, including digital signatures, integrity checks, and version controls. The vehicle should be able to verify if a package originates from a trusted source, remains unaltered, and is intended for the designated component.

However, a valid signature alone is not always sufficient. Older, originally correctly signed software may still contain known security vulnerabilities. Uptane accounts for attacks where systems are reverted to older versions or are cut off from newer updates. Manufacturers must therefore secure the entire update process.

"Software updates are a necessary evil in cybersecurity," notes Professor Johansson. "They are essential for patching vulnerabilities, but the update mechanism itself can be a target. Uptane and similar frameworks are crucial for establishing trust in the update process. This includes ensuring the authenticity and integrity of the update itself, as well as preventing rollback attacks that could reintroduce vulnerabilities."

The Manufacturer’s Enduring Responsibility

Cybersecurity is now an integral part of vehicle homologation. United Nations Economic Commission for Europe (UNECE) Regulation No. 155 addresses cybersecurity, and its complementary regulation, No. 156, deals with software update management. These regulations signify a global recognition of the critical role cybersecurity plays in vehicle safety and roadworthiness.

"The regulatory landscape is evolving rapidly to reflect the realities of connected vehicles," states Dr. Sharma. "These regulations place a significant burden on manufacturers to demonstrate robust cybersecurity practices throughout the vehicle lifecycle. It’s no longer an afterthought but a fundamental requirement for bringing vehicles to market."

Empowering Drivers: What Consumers Can Do

While the primary responsibility for vehicle cybersecurity lies with manufacturers, drivers are not entirely powerless. Staying informed about potential risks and adopting cautious practices can contribute to overall security.

• Be Vigilant About App Permissions: Review the permissions granted to vehicle companion apps. Understand what data they access and why. Limit permissions to only what is strictly necessary for the app’s functionality.
• Secure Your Wi-Fi and Home Network: Many vehicles connect to home Wi-Fi networks. Ensure your home network is secured with a strong password and up-to-date security protocols.
• Beware of Phishing Attempts: Be skeptical of unsolicited emails or messages asking for personal or vehicle-related information. Always verify the legitimacy of any communication before providing sensitive data.
• Keep Software Updated: While the update process itself can have risks, keeping your vehicle’s software and companion apps updated is generally advisable, as updates often include critical security patches.
• Research Vehicle Security: Before purchasing a vehicle, research its known cybersecurity vulnerabilities and the manufacturer’s commitment to addressing them.
• Report Suspicious Activity: If you notice any unusual behavior with your vehicle’s connected features, report it to your dealership or the manufacturer immediately.

The automotive industry is at a critical juncture. As vehicles become increasingly sophisticated and integrated into our digital lives, the threat landscape of cybersecurity continues to evolve. The findings from the University of Gothenburg serve as a vital wake-up call, urging a paradigm shift in how we approach automotive security – one that embraces the interconnected nature of modern vehicles while robustly defending against the ever-present digital threats. The future of driving depends on it.