Eaton • Jul 27, 2026

Key Points / Summary

  • VE Commercial Vehicles, a joint venture between the Volvo Group and Eicher Motors, builds and maintains a fleet management system called My Eicher for Indian commercial vehicle customers.
    • “My Eicher is a complete fleet management & vehicle GPS tracking system designed for commercial vehicle owners, fleet managers, & operators. With our highly advanced telematics platform, you can take control of your fleet like never before.”
  • A vulnerability was found in the APIs that made it possible to discover hidden, unauthenticated internal/admin APIs. These APIs could be used to gain high-level access to systems and even enable account takeover.
  • Account takeover made it possible to gain control over a person’s (or company’s) entire fleet, which could consist of hundreds of vehicles.
  • Exposed data by the numbers. As of November 2024, it was announced that 275k vehicles and 115k customers are registered. It is unclear why some of these numbers pulled from the API are significantly higher.
    • 748k customers
    • 174k users
    • 186k persons
    • 676k vehicles
    • 76k documents (Aadhaar cards, driving licenses, etc)

Welcome to my next blockbuster automotive hack! This one has been in the works for a long time with roots going back to early 2024 when I disclosed the Toyota insurance company hack. Fun fact: I was actually trying to find a vulnerability in My Eicher at that time, but was unsuccessful. It wasn’t until more than a year later in 2025 that I stumbled upon a breakthrough that cracked My Eicher wide open.

My Eicher

Unless you are in India, you probably haven’t heard of My Eicher before. It is an app/website that lets commercial vehicle customers track and manage their fleets of trucks and buses. You can do fun things like real-time-track vehicles, view the live gauge clusters, set geofences, and so much more. The website is here, and there is an Android and iPhone app.

The vulnerabilities being disclosed here only impact commercial vehicles and customers in India.

A lucky breakthrough

The vulnerability was incredibly simple and discovered through sheer luck. Here is an API that is used on the homepage of the website to check your mobile #: https://www.myeicher.in/cepauthmgr/user/validateMobileNo

The Javascript on the website has many other APIs like that. There were some other interesting ones, but nothing that could be used to hack the entire platform. Then, just randomly one day, I decided to try going to this endpoint on my browser: https://www.myeicher.in/cepauthmgr/user/

In 99% of cases, walking up the API path results in an HTTP error. This time, it revealed a big list of all the user-related APIs:

You can view the full list here.

Even better, they were unauthenticated! I found a “customers” endpoint and it revealed a massive list of 748k customers:

There were also “users” and “persons”:

It even returned the password to you. It was encrypted though, so it couldn’t be used. This was still a massive breakthrough – it was no longer difficult to find people who use this system. These APIs gave me the entire list of accounts. If there was some sort of login exploit, it would be game over for everyone in here.

All your OTPs are mine

My luck continued to grow: there was an API that returned the entire list of 2.5 million OTPs going back to 2021:

There were also more specific APIs to return OTPs for specific mobile #s:

You can probably guess where this is going. The stage has been set for an account takeover!

Step 1: Pick a mobile # from the user list and send the OTP. I picked one linked to a large engineering company.

Step 2: Use the API to find the OTP by mobile #:

Step 3: Plug it in. This technique gave me full control over any user account, and by extension, the vehicles/fleets.

The side effect of all this is that you tip off the person by actually sending them the OTP, so it’s unfortunately not a silent account takeover. However, there was a second account takeover method! There are APIs to update the password on the account, so you could set one and then log in using password. The user presumably would not be notified, but I am not 100% sure.

Exploring

Here’s some additional screenshots documenting what kind of things I had access to.

This is the response from the vehicles API. There were 676k!

This is a map that lets you track all your vehicles:

Here are the individual tracking details of specific vehicles:

The live vehicle cluster, which supposedly is representative of what the driver sees:

Here are many other features:

Sensitive Data

It gets worse! There were a few APIs relating to documents that revealed 76k documents and images people have uploaded. This includes very sensitive ID documents like Aadhaar cards and driving licenses.

Timeline

I found someone who had reported a vulnerability to VECV in the past and they gave me their infosec email address.

  • November 3, 2025: Reported.
  • November 10, 2025: No response, followed up.
  • November 17, 2025: No response, followed up and copied some additional people on the thread.
  • November 20, 2025: It was no longer possible to access any of the internal APIs. The primary vulnerability was now fixed.
  • July 27, 2026: Published

After November 2025, I had some additional concerns that I attempted to relay to them, including over the general customer support line, but was unsuccessful in getting in contact with anyone there who cared enough to investigate them. After a few months of waiting, I gave up on these other concerns. At least they fixed the primary vulnerability.

Subscribe to new posts

Get an email notification every time something new is published.