One Parent Path Unlocked 676,000 Connected Trucks

Someone deleted the last segment of a URL and got the keys to 676,000 trucks.

That's the actual mechanism behind the My Eicher compromise disclosed today by Eaton Zveare, the researcher who publishes as EatonWorks. My Eicher is the fleet-telematics platform for VE Commercial Vehicles, the Volvo Group and Eicher Motors joint venture that sells trucks and buses from 2 to 55 tonnes across India. Zveare noticed the app calling something like /cepauthmgr/user/validateMobileNo, tried the parent path /cepauthmgr/user/, and got back an index of every user-management API the service exposed. Unauthenticated. Not a subset — the list.

What sat behind that index is the part worth staring at. /customers returned 748,000 records. /vehicles returned 676,000. /users and /persons added 174,000 and 186,000. Roughly 76,000 uploaded identity documents — Aadhaar cards, driving licences — were reachable. For scale: VECV publicly announced 275,000 vehicles and 115,000 customers on the platform in November 2024, so the tables carry a good deal of history and inactive records beyond the live fleet. Either number is a lot of freight.

Then the OTP endpoint. An API returned 2.5 million one-time passwords going back to 2021, and another let you pull the OTP for a specific mobile number. That converts information disclosure into a general-purpose login. Request an OTP for any account, read it out of the API, walk in the front door. Password reset worked too.

The OTP table is the whole lesson

Every team building phone-number auth in a market where email is secondary has written this code. Generate a six-digit code, write it to a table, SMS it, compare on submit. It works, it ships, and it quietly creates the single most dangerous relation in your schema: a row-by-row transcript of every authentication decision your system has ever made.

Two things went wrong and they're separable. First, the codes persisted — 2.5 million of them, five years' worth. An OTP is a credential with a ninety-second job. Store a hash, set a TTL, mark it consumed on first use, drop the row. There is no product feature that requires a 2021 login code to still be readable in 2026, and "we keep it for audit" is satisfied by storing the fact of a verification, not the secret.

Second, and worse: something in the service layer was willing to read that table over HTTP. Any endpoint that can return an OTP is an authentication oracle regardless of what it's nominally for. This is the failure mode of treating authorization as an annotation you remember to add rather than a wall everything sits behind. If your policy is default-allow with per-route opt-in, then any route nobody thought about — scaffolded, generated, inherited from a template, added by a contractor sprinting to a launch date — is public by construction. Default-deny at the edge is the only configuration that survives an org chart.

The endpoint naming is a tell, incidentally. /customers, /users, /persons, /vehicles — pluralised entity names sitting at a base path that returns a machine-readable index of itself — is exactly what a repository-scaffolding layer like Spring Data REST produces if you let it publish your domain model and never lock the front. Zveare doesn't name the stack and neither will I, but the shape is familiar enough that it's worth grepping your own service for. Practical version: enumerate the parent of every path your clients call. Then the grandparent. curl them in prod, not staging. Framework-generated discovery documents and leftover Swagger UIs are the cheapest recon in the business, and they don't show up in a threat model written around ECUs.

The regulation is pointed at the wrong layer

Here's where this stops being one vendor's bad week. India's AIS-189 lands as a mandatory automotive cybersecurity standard for new vehicles by 2027, closely modelled on UN R155, with ISO/SAE 21434-style TARA analysis and a certified CSMS behind it. R155 does formally cover back-end servers — Annex 5 has a whole part on infrastructure outside the vehicle, including unauthorised internet access to servers supporting fleets. But the machinery around it, the type approval, the audit evidence, the threat catalogue, is built for embedded software and CAN traffic. It is not built to notice that a Java web application published its ORM.

Nothing about a CSMS certificate would have caught /cepauthmgr/user/, and the joint-venture structure makes it less likely still: a local IT organisation building a domestic telematics portal is a long way from the group cybersecurity function that signs the type approval. Zveare notes the flaws affect only Indian commercial vehicles and customers, which is precisely the point. Global OEMs export process to their home markets and outsource platforms in their growth ones.

The privacy exposure has sharper teeth. India's DPDP Rules were notified on 14 November 2025 — eleven days after Zveare filed his report — with breach reporting to the Data Protection Board inside 72 hours and penalties up to ₹200 crore for failing to notify. Most of those obligations phase in through mid-2027, so this incident falls in the gap. A functionally identical bug found in 2028 does not.

Calibrating the damage

Be precise about what this was and wasn't. There's no evidence in the disclosure of immobiliser access, engine cut-off, or any actuator reachable from the platform. This is not the 2024 Kia dealer-portal work, where a licence plate got you unlock-and-start in under thirty seconds. Account takeover here yielded live tracking maps, per-vehicle position, live gauge-cluster views, geofencing, and the fleet's documents.

For commercial freight, that's arguably the worse trade. A hijacked consumer car is one car. Continuous position data on hundreds of trucks per account is cargo-theft targeting, competitive intelligence on a logistics operator's routes and utilisation, and location surveillance of drivers who never consented to any of it — at 676,000-vehicle scale, silently, with no notification to the account owner.

The disclosure itself is the last indictment. Zveare had to get an infosec contact from another researcher who'd reported to VECV before; no advertised programme, no security.txt. Reported 3 November 2025, chased on the 10th, chased again on the 17th with more recipients copied, fixed on the 20th. Seventeen days to remediate once someone read the mail is genuinely fine. Zero replies across the whole exchange is not, and it left additional concerns he spotted after the fix with nowhere to go. He filed the Toyota supplier-portal report on 3 November too, three years earlier, and got the same silence and a similar three-week fix. The bug class isn't the only thing the industry keeps reshipping.