Researchers Identify 413 Automotive Software Vulnerabilities, Showing a Shift to Cloud Vectors
An analysis of 413 automotive flaws reveals external cloud services and mobile apps now form the leading attack surface.
Researchers from the University of Gothenburg and Chalmers University of Technology analyzed 413 automotive software vulnerabilities identified between January 2022 and September 2024, according to a study published in the Software Quality Journal springer.com
Software Quality Journalspringer.comOpen source ↗. By scanning databases and software repositories, the team tracked modern attack vectors across the entire Software Development Life Cycle (SDLC) to determine how digital threats to connected vehicles have evolved.
Shift to Web and Cloud Vectors
The data shows that mobile applications, websites, and cloud services linked to connected vehicles now represent 36.2% of identified vulnerabilities, becoming the most exposed category. When comparing current records to the 2010–2019 period, the share of external software weaknesses climbed from 14.5% to 41.3%, while the proportion affecting embedded onboard systems dropped from 69.1% to 44.3%. Furthermore, high-severity flaws accounted for 44.8% of the total, and critical vulnerabilities rose from 5.1% to 16.3%. Traditional web security issues dominate this segment: SQL injection emerged as the most frequent technique, followed by cross-site scripting.
Supply Chain and Embedded Risks
The authors also audited 20 automotive software repositories, scanning source trees, Software Bills of Materials (SBOMs), images, and manifest files. This automated inspection uncovered 827 vulnerable reusable software libraries, including shared cryptographic modules used across multiple implementations. Among hardware and chip providers, Qualcomm accounted for 58 reported vulnerabilities, reflecting market penetration and vendor reporting habits.
While remote access through web endpoints presents an immediate data risk, vehicle interiors remain exposed if infotainment and telematics units lack isolation from internal communication buses springer.com
Software Quality Journalspringer.comOpen source ↗. In 2023, ethical hackers bypassed vehicle boundaries to access steering and braking controls through multimedia systems. The researchers emphasize that engineering teams must enforce architectural separation between remote-facing endpoints and core automotive actuators.
