![\"Hacker\"](\"https:\/\/teknomers.com\/en\/wp-content\/uploads\/2025\/08\/Unlocking-the-car-via-mobile-offers-convenience-but-a-recent.png\"\/)
\n <\/div>\n<\/div>\n
In the \u00a0United States\u00a0, laws regulating vehicle sales vary by state, but they share a fundamental principle: in most instances, \u00a0manufacturers cannot sell new cars directly to consumers\u00a0. They must go through independent dealerships, which are legally safeguarded against direct competition from the manufacturer. This has led to a \u00a0franchised network structure\u00a0 that consolidates thousands of sales and after-sales points.<\/p>\n
<\/p>\n
Tesla has tried to break away from this model and sell directly, but it has not proven easy. While it has succeeded in a few states, many others still impose legal restrictions that prevent it from selling or delivering vehicles directly. Tesla’s circumstance is the most visible exception, but it is certainly not the norm.<\/p>\n
<\/p>\n
The most concerning aspect is not merely that this system displayed confidential information. The serious issue is that it allowed actions with \u00a0high privileges\u00a0, as if one were part of the official manufacturer structure. This meant it was possible to impersonate the identities of other employees, intervene in registered vehicles throughout the nation, or access functionalities intended only for authorized technicians.<\/p>\n
<\/p>\n
The portal was designed to facilitate actions within the dealer network, not to resist \u00a0malicious access from within\u00a0.<\/p>\n<\/p><\/div>\n<\/div>\n
As previously mentioned, each car has a unique \u00a0frame number\u00a0. This code consists of 17 characters\u2014both letters and numbers\u2014that legally identify the vehicle worldwide.<\/p>\n
<\/p>\n
What the average driver likely does not realize is that this code is visible from the outside, located at the base of the windshield. In the context of this case, it served as the key to access. In a real test, \u00a0Zveare entered a visible VIN from the outside\u00a0 and obtained the name of the owner. Moreover, through the portal, it was also possible to link the vehicle to a new mobile account.<\/p>\n
<\/p>\n
Zveare did not attempt to drive any vehicles or alter their physical configurations. However, with the level of control he possessed, it would have been entirely possible to unlock vehicles remotely and empty their interiors.<\/p>\n
<\/p>\n
Currently, \u00a0the name of the affected manufacturer has not been disclosed\u00a0. While the researcher is aware of the brand behind the compromised portal, he chose not to mention it in his report or during his defense presentation. Similarly, TechCrunch, the first media outlet to cover the story, has also refrained from revealing the identity of the manufacturer.<\/p>\n
<\/p>\n
![\"Tesla's](\"https:\/\/teknomers.com\/en\/wp-content\/uploads\/2025\/08\/Unlocking-the-car-via-mobile-offers-convenience-but-a-recent.jpeg\"\/)
\n <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\nThis is not an unusual practice. In certain cases, researchers opt to maintain the anonymity of the involved company for prudence\u2019s sake, even after the vulnerability has been resolved, to avoid endangering third parties: dealerships, employees, or customers who continue to rely on that system. The fact that the compromised platform granted access to entire networks rather than just isolated servers may also have influenced this decision.<\/p>\n
<\/p>\n
Images | Xataka with Gemini 2.5 Flash<\/p>\n
In Xataka | Bugatti decided not to put speakers in a car of four million euros. His secret is a technique of 1881.<\/p>\n