Researchers reviewing 413 reported automotive software vulnerabilities found that security weaknesses increasingly concern applications and services around vehicles, extending the work of protecting a car beyond its onboard electronics.
The University of Gothenburg publicized the findings on October 21. The study, published in Software Quality Journal on September 12, examined reports from 2022 through September 2024 and compared them with earlier research.
For automakers and fleet operators, the commercial issue extends across vehicle software, customer accounts, remote services and maintenance. A connected function depends on the security of the systems it communicates with as well as the equipment inside the car.
Reported flaws are not a count of hacked cars
The peer-reviewed study was conducted by Srijita Basu, Miroslaw Staron, Magnus Almgren, Jennifer Horkoff and Christian Berger, affiliated with the University of Gothenburg and Chalmers University of Technology.
It mapped reported weaknesses across the connected-vehicle ecosystem and stages of software development. About 45% of the 413 vulnerabilities had a high severity rating. The researchers separately scanned 20 automotive-related software repositories and identified 827 vulnerable libraries.
A library is reusable software that can be incorporated into a larger system. A weakness in shared code may matter to several products, so reviewing only software written directly by a vehicle manufacturer can leave gaps.
Neither figure counts compromised vehicles. A reported vulnerability is a weakness; exploiting it requires the relevant conditions and access. Finding a vulnerable library in a repository also does not establish that every vehicle using related software contains an exploitable version.
The authors acknowledge limits in the repository sample, scanning tools and manual classification. Public disclosures also depend on what researchers and companies discover and report.
The service outside the vehicle matters
In its research announcement, the university says the share of reported weaknesses associated with apps, websites and cloud services has nearly tripled compared with the earlier period. That is a change in the composition of reported flaws, not a measurement of a driver’s probability of being attacked.
Basu recommends separating systems that control the vehicle from infotainment and other connected functions. Infotainment combines features such as audio, navigation and media access.
“Car owners also have a responsibility to make things more difficult for hackers,” she said, recommending prompt software updates and strong passwords.
Separating systems can limit how far an intrusion spreads. Protecting a customer account and restricting which commands a remote service can issue address different parts of the problem. A secure login cannot substitute for controls inside the vehicle, and vehicle controls cannot protect information left exposed by a remote service.
For a fleet business, questions about access should include what happens when a driver leaves, a vehicle changes hands or an external provider’s contract ends. Those are operational implications of connected services, not outcomes measured by this research.
Security has to continue after the sale
The US National Highway Traffic Safety Administration’s vehicle cybersecurity guidance promotes layered protection, prioritizing safety-critical systems, timely detection and response, and designs that allow recovery after an incident.
Layered protection assumes that one defense may fail. It combines prevention with limits on access, monitoring and a way to restore dependable operation.
Our earlier reporting on the continuing costs of business data services examined why connectivity requires ongoing funding and coordination. Vehicle services likewise create responsibilities that do not end when the hardware is delivered.
A buyer assessing a connected fleet therefore needs to know who provides updates, how long support lasts and how security reports reach the responsible supplier. The vehicle and its remote services may remain in use long after their original purchase agreements were signed.
