Researchers reported that a flaw in Kia's dealer portal let them take over a connected vehicle knowing only its license plate. The weakness was in a web API, not in the car. Kia said it fixed the issue in August 2024, and the researchers disclosed it in September 2024 after validating the fix.
What the researchers found
According to the researchers' write-up, the dealer portal exposed an API that let anyone register a dealer account with ordinary credentials. That account could generate a token and look up vehicle records by VIN, which exposed the owner's name, email address and phone number.
From there, they used four API calls to demote the registered owner and add themselves as the primary owner. A third-party service converted a license plate into a VIN, so the plate was the only input needed.
With ownership, they could send commands such as unlock, start and stop, honk and locate. The write-up says it worked on hardware-equipped vehicles in about 30 seconds, whether or not the vehicle had an active subscription, and the owner received no notification.
Why this is a backend story
Nothing in the attack touched the vehicle's radio or its internal bus. The trust decision was made on a server: who counts as a dealer, and who counts as an owner. When that decision is weak, every connected feature downstream inherits the weakness.
This is the pattern that matters for any connected product, including robots and drones. The app, the cloud and the device form one system. The device is only as protected as the account model that commands it.
The three failures in the chain
- Open registration for a privileged role. A dealer account should not be something anyone can create.
- Broad lookup by an easily obtained identifier. A VIN, or a plate that maps to one, is not a secret.
- Ownership changes without owner consent or notice. A change that moves control of a physical object should alert the old owner and, ideally, need their approval.
Any one of these being fixed would have broken the chain.
What to check in your own connected product
- Can a privileged role be created through a public endpoint?
- Do API responses return personal data that the caller has no need for?
- Are role and ownership changes logged, and does the old owner get notified?
- Is there a second factor or a physical proof step before control of a device moves to a new account?
- Do you test the dealer, installer and support tooling with the same rigor as the consumer app?
Internal and partner portals are often the weakest part, because they were built for a small trusted audience and later exposed to the internet.
Scanning can catch some web application flaws, and a free Safeguard scan is available at https://gold.safeguard.sh/scan. Authorization logic such as a role model still needs a human review.
Quick check
Did the attack need access to the car?
No. The write-up describes it as a web API flaw, driven by a license plate.
Was it fixed?
Yes. Kia said it remediated the issue on 14 August 2024, and the researchers disclosed publicly on 26 September 2024 after validating the fix.
Sources
Last reviewed: 19 October 2026.
