Researchers from a prominent security firm have exploited a glaring vulnerability in two major automakers’ systems, allowing them to unlock and start cars using nothing but their login credentials. The issue lies in the default “admin:admin” server password used by these manufacturers, which is essentially an open invitation for hackers to gain unauthorized access.
The researchers discovered that the default password, often left unchanged by manufacturers, grants users complete administrative privileges on a vehicle’s onboard computer system. This allows them to remotely monitor and control various systems, including engine start/stop functions, navigation, and even infotainment systems. By leveraging this vulnerability, hackers can essentially take control of a car’s digital infrastructure.
The researchers exploited the default password on two different automakers’ systems: a luxury brand and a mass-market manufacturer. While neither company has publicly disclosed which specific models are affected, industry insiders claim that multiple vehicles from these brands have been compromised. To make matters worse, this vulnerability is not unique to these manufacturers; other companies may be using similar default passwords, leaving their customers exposed.
The researchers explained that the issue stems from a combination of factors: outdated software, inadequate security measures, and an over-reliance on default credentials. In many cases, manufacturers rely on third-party suppliers for key components, including onboard computer systems. These suppliers often set default passwords to ease testing and integration – but forget to update them before shipping.
The implications of this vulnerability are far-reaching. If exploited by malicious actors, it could enable a range of attacks, from theft and vandalism to more sinister activities like surveillance or even hijacking. The researchers emphasize that the primary concern is not the potential for hacking but rather the widespread lack of awareness about default passwords among manufacturers and consumers alike.
In light of this discovery, car owners should be aware of their vehicle’s digital vulnerabilities and take proactive steps to mitigate them. This includes regular software updates, secure login credentials, and a thorough understanding of onboard computer systems. By addressing these issues, drivers can minimize the risk of cyber-related attacks on their vehicles.
Source: The Hacker News — 2026-11-09