Loading story…
Critical vulnerabilities in VE Commercial Vehicles' My Eicher fleet management platform exposed undocumented, unauthenticated internal and administrative APIs that allowed attackers to enumerate customers, users, vehicles, historical OTPs, and sensitive uploaded documents. Reporting on the disclosure said the exposure affected roughly 748,000 customers and 676,000 vehicles tied to the Volvo Group and Eicher Motors joint venture in India, with accessible data including mobile numbers, encrypted passwords, identity documents, and vehicle geolocation.
The researcher said the flaws enabled account takeover by retrieving a victim's OTP or abusing password-reset functions without apparent user notification, which could have granted full access to fleet tracking and management features for arbitrary customer accounts. The issues were reported to VECV in November 2025, the main vulnerable API access was removed on November 20, 2025, and additional weaknesses were remediated on July 28, 2026; the public disclosure described the platform as secured with no current threat to customers or vehicles.
See affected versions and whether adversaries are exploiting it.
9 events from the most recent confirmed update back to the earliest known activity.
The researcher published a public disclosure describing the My Eicher vulnerabilities on July 27, 2026. The post detailed exposed customer, user, vehicle, OTP, and document data and the account-takeover paths.
By November 20, 2025, access to the exposed internal My Eicher APIs was no longer possible, indicating the primary vulnerability had been fixed. This remediation addressed the unauthenticated internal/admin API exposure.
The researcher followed up again on November 17, 2025, copying additional recipients. This escalation came before the vulnerable internal APIs were removed.
After receiving no response, the researcher followed up with VECV on November 10, 2025. This was part of the responsible disclosure process.
The researcher disclosed the vulnerability to VE Commercial Vehicles on November 3, 2025. The report concerned exposed internal APIs that allowed access to customer, vehicle, OTP, and document data and enabled account takeover.
In 2025, the researcher discovered undocumented unauthenticated internal and administrative API endpoints in My Eicher that exposed sensitive data and enabled account takeover. The flaws could have allowed control over customer accounts and associated vehicle fleets.
The disclosure states that My Eicher had announced 275,000 registered vehicles and 115,000 customers as of November 2024. This provides context for the platform's scale before the later vulnerability report.
The researcher said an earlier attempt to find vulnerabilities in the My Eicher platform did not succeed. This attempt was explicitly placed in early 2024.
Additional security concerns in My Eicher were remediated on July 28, 2026 in coordination with VECV. The disclosure states that after this work there was no current threat to customers or vehicles.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceeaton-works.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Advantech released security updates for **EKI-series industrial wireless access points** after researchers disclosed **20 vulnerabilities**, including **six critical flaws** tracked as `CVE-2024-50370` through `CVE-2024-50375`. The most severe issues affect over-the-air functionality and can let a **remote, unauthenticated attacker** bypass authentication, execute arbitrary code as **root**, and take full control of exposed devices. The affected products are **EKI-6333AC-2G** and **EKI-6333AC-2GD** running firmware earlier than **v1.6.5**, and **EKI-6333AC-1GPO** running firmware earlier than **v1.2.2**. Additional high-severity weaknesses could enable **cross-site scripting**, **system command injection**, **denial of service**, and unauthorized access to sensitive data. Defenders are advised to **immediately upgrade firmware** to the vendor-fixed versions and review internet-exposed or operational technology deployments using these access points.
Jul 24, 2026
AVEVA disclosed **seven vulnerabilities** in *AVEVA Process Optimization* (formerly *ROMeo*) affecting version **2024.1 and earlier**, including a **CVSS v4.0 10.0** issue, **CVE-2025-61937**, that enables **unauthenticated remote code execution as OS `SYSTEM`**. The flaw is described as a **code injection vulnerability in the application’s API layer** and can allow remote attackers with network access to execute arbitrary code under the `taoimr` service context, potentially leading to full compromise of the **Model Application Server** and connected industrial modeling infrastructure; the attack is characterized as remote, low-complexity, and requiring no user interaction. Additional high-severity issues reported alongside the RCE include **CVE-2025-64691** (macro/TCL script tampering enabling authenticated privilege escalation to `SYSTEM`), **CVE-2025-61943** (SQL injection in the **Captive Historian** component that can lead to SQL Server administrative access and code execution), and other critical/high findings such as **DLL hijacking** (**CVE-2025-65118**), **missing ACLs** (**CVE-2025-64729**), **embedded OLE object** risks (**CVE-2025-65117**), and **cleartext transmission** exposure (**CVE-2025-64769**). AVEVA’s bulletin emphasizes that multiple paths exist to compromise affected servers—either directly via the unauthenticated API RCE or via authenticated user-to-`SYSTEM` escalation—raising immediate risk for organizations operating vulnerable industrial process optimization deployments.
Jun 29, 2026
A critical command injection vulnerability, tracked as CVE-2025-58428, has been identified in the Veeder-Root TLS4B Automatic Tank Gauge (ATG) System. The flaw resides in the system's SOAP-based web services interface, which allows remote attackers with valid credentials to execute arbitrary system-level commands on the underlying Linux operating system. Successful exploitation could grant attackers full shell access, enable remote command execution, and facilitate lateral movement within affected networks, posing a significant risk to organizations relying on these systems for fuel management and monitoring. Security advisories highlight that all versions of the TLS4B system prior to 11.A are affected. In addition to the command injection issue, the system is also vulnerable to an integer overflow related to Unix time handling, which could cause system resets after the 2038 epoch rollover. The vulnerabilities are rated as critical, with CVSS scores of 9.9 (v3.1) and 9.4 (v4), and could result in denial of service, administrative lockout, or disruption of core functionalities if exploited. Organizations are urged to review vendor guidance and apply mitigations to protect against these threats.
Jun 29, 2026