How Unauthenticated APIs Exposed Volvo Eicher's My Eicher Fleet Platform
Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles
I discovered critical vulnerabilities in the My Eicher fleet management platform, a joint venture between Volvo Group and Eicher Motors. By stumbling upon unauthenticated internal APIs, I gained access to millions of OTPs and sensitive user data. This flaw allowed me to take over accounts and control entire fleets of commercial vehicles across India, exposing hundreds of thousands of customers and their vehicles to potential compromise.
Welcome to my next blockbuster automotive hack! This one has been in the works for a long time with roots going back to early 2024.
- darknavi
> November 3, 2025: Reported.
> November 10, 2025: No response, followed up.
> November 17, 2025: No response, followed up and copied some additional people on the thread.
> November 20, 2025: It was no longer possible to access any of the internal APIs. The primary vulnerability was now fixed.
> July 27, 2026: Published
Quite the generous timeline on this person's behalf.
- Xeoncross
There is security that protects users and then there is security theater that provides litigation protection for the company.
Sometimes overlapping, but they are not the same thing.
- wkjagt
I should look into how this affects my 1981 Volvo 244
- spockz
This is my primary concern with modern cars. You are at the complete merci of the security and correctness of the cloud management software for the correctly functioning of the car.
Wouldn’t it be better if your phone/devices would pair directly with the car, exchange keys, and have the company cloud only function as a proxy.
On holiday a guests BMW didn’t want to “start” anymore because it couldn’t phone home because of lack of phone reception. They had to contact the dealer at home and move heaven and earth to get some dealer code to allow the car to start again for a while. Why is this even allowed?
- superloika
I feel obligated to post this very cool FSF Car right-to-repair video