Exploiting Volvo/Eicher’s fleet management platform to gain control over all users and vehicles
Exploiting Volvo/Eicher’s fleet management platform to gain control over all users and vehicles
利用沃尔沃/Eicher车队管理平台漏洞获取所有用户及车辆控制权
Eaton • Jul 27, 2026
VE Commercial Vehicles, a joint venture between the Volvo Group and Eicher Motors, builds and maintains a fleet management system called My Eicher for Indian commercial vehicle customers. “My Eicher is a complete fleet management & vehicle GPS tracking system designed for commercial vehicle owners, fleet managers, & operators. With our highly advanced telematics platform, you can take control of your fleet like never before.” VE Commercial Vehicles（沃尔沃集团与 Eicher Motors 的合资企业）为印度商用车客户构建并维护着一套名为“My Eicher”的车队管理系统。“My Eicher 是一套专为商用车车主、车队经理及运营商设计的完整车队管理与车辆 GPS 追踪系统。借助我们高度先进的远程信息处理平台，您可以以前所未有的方式掌控您的车队。”
A vulnerability was found in the APIs that made it possible to discover hidden, unauthenticated internal/admin APIs. These APIs could be used to gain high-level access to systems and even enable account takeover. Account takeover made it possible to gain control over a person’s (or company’s) entire fleet, which could consist of hundreds of vehicles. 研究人员在 API 中发现了一个漏洞，该漏洞使得发现隐藏的、未经身份验证的内部/管理 API 成为可能。这些 API 可被用于获取系统的高级访问权限，甚至实现账户接管。账户接管意味着攻击者可以控制某个人（或公司）的整个车队，其中可能包含数百辆汽车。
Exposed data by the numbers. 泄露数据统计。
As of November 2024, it was announced that 275k vehicles and 115k customers are registered. It is unclear why some of these numbers pulled from the API are significantly higher. 截至 2024 年 11 月，官方宣布注册车辆为 27.5 万辆，客户为 11.5 万名。目前尚不清楚为何从 API 中提取的部分数据远高于此：
- 748k customers (74.8 万名客户)
- 174k users (17.4 万名用户)
- 186k persons (18.6 万名个人)
- 676k vehicles (67.6 万辆汽车)
- 76k documents (Aadhaar cards, driving licenses, etc) (7.6 万份文档，包括 Aadhaar 卡、驾驶证等)
Welcome to my next blockbuster automotive hack! This one has been in the works for a long time with roots going back to early 2024 when I disclosed the Toyota insurance company hack. Fun fact: I was actually trying to find a vulnerability in My Eicher at that time, but was unsuccessful. It wasn’t until more than a year later in 2025 that I stumbled upon a breakthrough that cracked My Eicher wide open. 欢迎来到我的下一个重磅汽车黑客案例！这个项目筹备已久，其渊源可以追溯到 2024 年初我披露丰田保险公司黑客事件时。有趣的是，当时我其实就在尝试寻找 My Eicher 的漏洞，但并未成功。直到一年多后的 2025 年，我偶然发现了一个突破口，彻底攻破了 My Eicher。
My Eicher 关于 My Eicher
Unless you are in India, you probably haven’t heard of My Eicher before. It is an app/website that lets commercial vehicle customers track and manage their fleets of trucks and buses. You can do fun things like real-time-track vehicles, view the live gauge clusters, set geofences, and so much more. The website is here, and there is an Android and iPhone app. The vulnerabilities being disclosed here only impact commercial vehicles and customers in India. 除非你在印度，否则你可能没听说过 My Eicher。它是一个让商用车客户追踪和管理卡车及巴士车队的应用程序/网站。你可以进行实时车辆追踪、查看实时仪表盘、设置地理围栏等多种操作。该网站在此，并提供 Android 和 iPhone 应用程序。此处披露的漏洞仅影响印度的商用车和客户。
A lucky breakthrough 幸运的突破
The vulnerability was incredibly simple and discovered through sheer luck. Here is an API that is used on the homepage of the website to check your mobile #: https://www.myeicher.in/cepauthmgr/user/validateMobileNo 该漏洞极其简单，完全是靠运气发现的。网站主页上有一个用于检查手机号码的 API：https://www.myeicher.in/cepauthmgr/user/validateMobileNo
The Javascript on the website has many other APIs like that. There were some other interesting ones, but nothing that could be used to hack the entire platform. Then, just randomly one day, I decided to try going to this endpoint on my browser: https://www.myeicher.in/cepauthmgr/user/ 网站上的 Javascript 代码中还有许多类似的 API。虽然有一些其他有趣的接口，但都无法用于攻击整个平台。直到某天，我随机决定在浏览器中访问这个端点：https://www.myeicher.in/cepauthmgr/user/
In 99% of cases, walking up the API path results in an HTTP error. This time, it revealed a big list of all the user-related APIs: You can view the full list here. Even better, they were unauthenticated! I found a “customers” endpoint and it revealed a massive list of 748k customers: There were also “users” and “persons”: 在 99% 的情况下，向上遍历 API 路径会导致 HTTP 错误。但这一次，它显示了一个所有用户相关 API 的完整列表（完整列表可在此查看）。更棒的是，它们竟然不需要身份验证！我找到了一个“customers”端点，它泄露了 74.8 万名客户的庞大列表，此外还有“users”和“persons”端点。
It even returned the password to you. It was encrypted though, so it couldn’t be used. This was still a massive breakthrough – it was no longer difficult to find people who use this system. These APIs gave me the entire list of accounts. If there was some sort of login exploit, it would be game over for everyone in here. 它甚至会返回密码。虽然是加密的，无法直接使用，但这仍然是一个巨大的突破——找到使用该系统的人不再困难。这些 API 给了我完整的账户列表。如果存在某种登录漏洞，这里的所有人就都完了。
All your OTPs are mine 你们的 OTP 全归我了
My luck continued to grow: there was an API that returned the entire list of 2.5 million OTPs going back to 2021: There were also more specific APIs to return OTPs for specific mobile #s: You can probably guess where this is going. The stage has been set for an account takeover! 我的运气还在持续：有一个 API 返回了自 2021 年以来的 250 万条 OTP（一次性密码）完整列表。还有更具体的 API 可以返回特定手机号码的 OTP。你大概能猜到接下来会发生什么。账户接管的舞台已经搭好了！
Step 1: Pick a mobile # from the user list and send the OTP. I picked one linked to a large engineering company. Step 2: Use the API to find the OTP by mobile #: Step 3: Plug it in. 第一步：从用户列表中选择一个手机号码并发送 OTP。我选了一个与一家大型工程公司关联的号码。 第二步：使用 API 通过手机号码查找 OTP。 第三步：输入 OTP。
This technique gave me full control over any user account, and by extension, the vehicles/fleets. The side effect of all this is that you tip off the person by actually sending them the OTP, so it’s unfortunately not a silent account takeover. However, there was a second account takeover method! There are APIs to update the password on the account, so you could set one and then log in using password. The user presumably would not be notified, but I am not 100% sure. 这种技术让我获得了对任何用户账户的完全控制权，进而控制了车辆/车队。这种方法的副作用是，由于实际向对方发送了 OTP，对方会收到提醒，所以很遗憾，这不是一种静默的账户接管。然而，还有第二种接管方法！存在用于更新账户密码的 API，因此你可以设置一个新密码，然后直接登录。用户大概率不会收到通知，但我不能 100% 确定。
Exploring 探索
Here’s some additional screenshots documenting what kind of things I had access to. This is the response from the vehicles API. There were 676k! This is a map that lets you track all your vehicles: Here are the individual tracking details of specific vehicles: The live vehicle cluster, which supposedly is representative of what the driver sees: Here are many other features: 以下是一些额外的截图，记录了我所能访问的内容。这是车辆 API 的响应，共有 67.6 万条！这是一张可以追踪所有车辆的地图，这里是特定车辆的详细追踪信息，这是实时车辆仪表盘（据称代表了驾驶员看到的内容），这里还有许多其他功能。
Sensitive Data 敏感数据
It gets worse! There were a few APIs relating to documents that revealed 76k documents and images people have uploaded. This includes very sensitive ID documents like Aadhaar cards and driving licenses. 情况更糟！有几个与文档相关的 API 泄露了人们上传的 7.6 万份文档和图片。其中包括 Aadhaar 卡和驾驶证等非常敏感的身份证明文件。
Timeline 时间线
I found someone who had reported a vulnerability to VECV in the past and they gave me their infosec email address. 我找到了一个过去曾向 VECV 报告过漏洞的人，他们给了我该公司的信息安全邮箱地址。
- November 3, 2025: Reported. (2025 年 11 月 3 日：报告漏洞。)
- November 10, 2025: No response, followed up. (2025 年 11 月 10 日：无回复，进行跟进。)
- November 17, 2025: No response, followed up and copied some additional people on the thread. (2025 年 11 月 17 日：无回复，再次跟进并抄送了邮件列表中的其他人。)
- November 20, 2025: It was no longer possible to access any of the internal APIs. The primary vulnerability was now fixed. (2025 年 11 月 20 日：无法再访问任何内部 API。主要漏洞已修复。)
- July 27, 2026: Published (2026 年 7 月 27 日：发布文章。)
After November 2025, I had some additional concerns that I attempted to relay to them, including over the general customer support line, but was unsuccessful in getting in contact with anyone there who cared enough to investigate them. After a few months of waiting, I gave up on these other concerns. At least they fixed the primary vulnerability. 2025 年 11 月之后，我还有一些额外的担忧试图传达给他们，包括通过常规客户支持热线，但未能联系到任何愿意调查这些问题的人。在等待了几个月后，我放弃了这些后续担忧。至少，他们修复了主要漏洞。