How Unauthenticated APIs Exposed Volvo Eicher's My Eicher Fleet Platform

Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles

I discovered critical vulnerabilities in the My Eicher fleet management platform, a joint venture between Volvo Group and Eicher Motors. By stumbling upon unauthenticated internal APIs, I gained access to millions of OTPs and sensitive user data. This flaw allowed me to take over accounts and control entire fleets of commercial vehicles across India, exposing hundreds of thousands of customers and their vehicles to potential compromise.