Automotive Cybersecurity

Q4 2025 automotive vulnerabilities span 64 unique CWEs

Q4 2025 severity breakdown: 146 Medium, 54 High and 2 Critical automotive vulnerabilities

Quarkslab bypassed the 16-byte RH850 debug password protection using voltage fault injection

Quarkslab's audit of EVerest open-source EV charging stack found 6 high-severity, 6 medium-severity, 5 low-severity and 3 informational issues

Ransomware group exfiltrated nearly 1 TB of data from a major Asian vehicle manufacturer's customer and dealership environment in early January 2026 via a third-party vendor

ShinyHunters vishing attack against an online automotive marketplace help desk exfiltrated 12.4 million user records (6.1 GB) in mid-February 2026

Synacktiv chained an information leak with an out-of-bounds write to achieve a full win against Tesla infotainment via USB at Pwn2Own Automotive 2026

UK SI 2025/1110 mandates UN R155 and R156 for type-approval effective 13 November 2025

Ultra-Fast Wireless Charging attack synchronises with the charger's signal within only three cycles, defeating frequency hopping countermeasures

Ultra-Fast Wireless Charging hack drained 76% of EV power on the Alpitronic HYC50 commercial DC fast charger

Ultra-Fast Wireless Charging hack drew 76%+ of the power intended for a legitimate EV from inductive chargers

US Commerce Department rule prohibits Chinese and Russian connected-vehicle software starting Model Year 2027

US connected vehicle hardware restrictions arrive for Model Year 2030 or January 1, 2029 for non-model-year components

US connected vehicle rule covers vehicles under 10,001 pounds

US SELF DRIVE Act of 2026 requires the Secretary of Commerce to brief Congress on connected vehicle supply chain security within 180 days

US Tier-1 automotive supplier had approximately 1.9 TB of internal files publicly posted on an extortion site at the end of October 2025

Web and Local Shell combined for 33% of Q1 2026 automotive attack vectors