Automakers' Android apps: RCE

Automakers' Android apps

Researchers exploited WAF bypasses and default logins to command vehicles in Australia and the US

Do this now

Check the vendor's advisory for an Android app fix, and restrict access to the affected apps and vehicle-facing services until one is confirmed.

Who should check: teams running Android

First seen: 9 Nov 2026
Last update: 9 Nov 2026, 18:18 UTC
Source: news
On the menu as: Android

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Automakers' Android apps: RCE
Severity: unknown. Patch status: fix status unknown.
Affected: Automakers' Android apps

Researchers exploited WAF bypasses and default logins to command vehicles in Australia and the US

## Steps
1. Search the repo, its CI and infra config for Automakers' Android apps. If present, report the version in use and whether it's affected.
2. No source names a fix yet; check the vendor advisory. Until one ships: restrict network access to it.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://www.theregister.com/security/2026/11/09/researchers-pwn-automakers-android-apps-to-remotely-unlock-cars-honk-horns/5308483
https://pwned.coffee/i/automakers-android-apps-rce

Receipt

Exploitation: No known exploitation
Score: No CVSS published yet: severity unknown.
Last checked: 13 Nov 2026, 16:26 UTC

Sources: KEV – CVE record – Vendor –

Sources

api.theregister.com: Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns

Follow on X

Totalone coffee