Exploiting VolvoEicher's fleet platform to gain control over all usersvehicles

How a Simple API Path Walk Exposed Volvo/Eicher's Entire Fleet

Unauthenticated internal APIs should, by now, be a historical footnote, confined to breach reports from a decade ago. Yet, security researcher Eaton Works recently uncovered precisely this vulnerability on Volvo/Eicher's My Eicher fleet management platform. This incident highlights how even established joint ventures can overlook fundamental security controls, with clear implications for hundreds of thousands of vehicles and their owners across India.

The Incident: Unprotected Endpoints on My Eicher

The incident, documented by the researcher on Eaton Works, began with initial vulnerability assessments of the My Eicher platform in early 2024. Operated by VE Commercial Vehicles (a Volvo Group and Eicher Motors joint venture), My Eicher provides fleet management and GPS tracking for commercial vehicles across India. The critical discovery emerged in 2025.

This wasn't a complex zero-day exploit; instead, the vulnerability lay in a series of unauthenticated internal and administrative APIs. The researcher simply enumerated API paths, starting from a known endpoint like https://www.myeicher.in/cepauthmgr/user/, to uncover sensitive endpoints such as /customers, /users, and /persons. These endpoints lacked any authentication, making them publicly accessible. This type of flaw is a classic example of API2: Broken Authentication, as outlined in the OWASP API Security Top 10 2023.

VECV received the vulnerability report on November 3, 2025. The core issue—public accessibility of these internal APIs—was patched by November 20, 2025. The full disclosure was released on July 27, 2026.

An abstract representation of data flowing through interconnected nodes, with one node highlighted as a vulnerable entry point, subtle digital glow, dark background, shallow depth of field. — Data flowing through interconnected nodes, with one node

The Mechanism: How Unauthenticated Access Led to Fleet Control

The core issue stemmed from a complete absence of authentication on these exposed APIs. This was not a sophisticated exploit chain, but a fundamental access control failure, a well-known vulnerability type categorized under MITRE ATT&CK T1505.002 (Web Server) for exposed API functionality.

An attacker could have exploited this vulnerability to compromise accounts and entire fleets. The sequence was straightforward:

Data Collection: The /users and /customers APIs exposed mobile numbers and other user details. While another API returned encrypted passwords, these were not immediately usable. Critically, the /otp/getOtpByMobileNo endpoint provided access to 2.5 million historical One-Time Passwords (OTPs) dating back to 2021, and could also retrieve current OTPs for any specified mobile number.
OTP Generation: Using a target mobile number obtained from the exposed user list, an attacker could trigger a new OTP generation via a legitimate, public API.
OTP Retrieval: The same /otp/getOtpByMobileNo API then allowed the attacker to retrieve the newly generated OTP for the target's mobile number.
Account Takeover: Possessing both the mobile number and the valid OTP, the attacker could then log in as the user. While the user would receive an OTP notification, the account would already be compromised.

A parallel path existed for password resets. Attackers could directly update an account's password via other APIs, then log in with the new credentials. It remains unclear if users received notifications for these password changes.

The Impact: Control Over Vehicles and Sensitive Data

This level of access had substantial practical implications. An attacker could achieve high-level control over the My Eicher system, facilitating the takeover of individual accounts or entire company fleets. This meant potential control over hundreds of vehicles.

The actual scale of exposed data far exceeded initial announcements. VECV reported 115,000 registered customers and 275,000 registered vehicles in November 2024. However, the API enumeration revealed:

Customers: 748,000
Users: 174,000
Persons: 186,000
Vehicles: 676,000
Documents: 76,000, including sensitive ID documents like Aadhaar cards and driving licenses.

With account control, an attacker could access real-time vehicle tracking, live gauge cluster data, and geofencing controls. This included individual vehicle tracking details and, more concerningly, the ability to view uploaded sensitive ID documents. Access to truck tracking data directly exposed sensitive personal and operational information.

A digital dashboard displaying vehicle tracking data and various metrics, with blurred sensitive documents in the background, futuristic UI elements, cool blue and green tones, shallow depth of field. — Digital dashboard displaying vehicle tracking data and various

The Response: Fixing the Hole, Learning the Lesson

VECV addressed the primary vulnerability promptly following the report. By November 20, 2025, the internal APIs were no longer publicly accessible. This swift action reflected a serious response to the disclosure.

The initial and prolonged exposure of these APIs points to a deeper, systemic problem in API security. Platforms managing sensitive data and physical assets should adhere to several non-negotiable principles:

The My Eicher incident underscores the critical need for explicit authentication on every API endpoint, a fundamental failure that allowed the initial enumeration. Implementing modern protocols like OAuth 2.1 or FIDO2 would have prevented this fundamental oversight, rather than relying on implicit trust.

Even with authentication, the My Eicher platform's exposed APIs demonstrated a lack of strict authorization. The system failed to verify not only who was making the call but also if that user possessed the necessary privileges for sensitive actions, a lapse that could have been mitigated by applying the principle of least privilege and preventing issues like OWASP API1:2023 Broken Object Level Authorization.

The exposure of 2.5 million historical OTPs on My Eicher highlights the importance of data minimization. If such sensitive data is not actively required for system function, it should not be stored, significantly reducing the attack surface.

While My Eicher's encrypted passwords were a start, the incident underscores the need for robust credential handling, including correct salting and hashing with modern algorithms like Argon2 or scrypt. Furthermore, the ability to retrieve current OTPs for any mobile number demonstrates a failure in managing OTP lifespans, which by design should be short and single-use, expiring within minutes.

This incident serves as a stark reminder that API security is not a one-time effort. Continuous, independent security audits, leveraging automated tools for API discovery and DAST, are standard practice precisely to proactively identify and remediate fundamental yet high-impact flaws like those found in My Eicher.

This incident wasn't a sophisticated nation-state attack; rather, it was a fundamental oversight that could have enabled widespread account takeovers and exposed sensitive personal data, including government IDs. The fix was straightforward, but the clear lesson here is to always assume API paths will be enumerated, and secure every endpoint accordingly.