Default Admin Credentials Exploit Enables Unauthorized Access to Automotive Systems

Researchers exploited default credentials in ForgeRock identity platforms to gain unauthorized access to automotive mobile apps, enabling them to unlock and start connected vehicles. The vulnerability highlights critical risks in IoT and authentication systems used by major automakers.

The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine.

Both apps signed customers in through ForgeRock, an identity platform now part of Ping Identity, and on those servers the researchers reached an

Read original article