Tata Motors iRA 2.0 vulnerabilities

3 known vulnerabilities in Tata Motors iRA 2.0 from Tata Motors. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.5 High severity

  Tata Motors iRA 2.0: Improper Certificate Validation

  CVE-2026-121147Nov 4, 2026Tata Motors

  This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept

• 7.1 High severity

  Tata Motors iRA 2.0: Origin Validation Error

  CVE-2026-121145Nov 4, 2026Tata Motors

  This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected

• 8.8 High severity

  Tata Motors iRA 2.0: Use of Hard-coded Credentials

  CVE-2026-121144Nov 4, 2026Tata Motors

  This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerabil