The telematics control unit, or TCU, is the vehicle's link to cellular networks and manufacturer services. It carries remote commands, location data and software updates, so it sits between the internet and the in-vehicle networks. A threat analysis should treat it as a boundary, with a gateway behind it.
What the TCU does
Telematics combines telecommunications and wireless communications with satellite navigation, most commonly GPS. Manufacturers use embedded telematics to provide remote start, remote door locking, vehicle health reports and navigation, often through a smartphone app. Car sharing services use an onboard device to track location, monitor usage and handle remote locking.
In the European Union, eCall is a mandated in-vehicle system that automatically contacts emergency services after a serious accident and sends the vehicle's location. Telematics devices also support stolen vehicle recovery.
Vehicle data for these services can be collected from the CAN bus or the OBD port. That detail is the heart of the issue: the same unit that talks to the cloud also listens to, and may speak on, in-vehicle networks.
Why it is a bridge
Three things meet at the TCU.
- Outside connectivity: cellular, and often a cloud account system.
- Vehicle networks: at least read access to CAN, sometimes write access for remote commands.
- Updates: the reference page says the TCU typically downloads and installs automotive updates over cellular.
A compromise of the cloud account, the cellular link or the unit's firmware can therefore reach in-vehicle systems unless something filters traffic.
A review checklist
- Inventory the interfaces. Cellular, Wi-Fi, Bluetooth, USB, diagnostic and any debug pins.
- Check what commands the cloud can send. Each remote command is a feature an attacker would also like to use.
- Check the gateway rules. What can the TCU send onto each network, and what is blocked?
- Check authentication. How does the unit prove its identity to the cloud, and how does the cloud prove its own?
- Check secrets. Where are keys and certificates stored, and is there hardware protection?
- Check updates. Are update images signed, and can the unit be restored if one fails?
- Check third party code. Modems and middleware often ship as components from suppliers, so ask for a bill of materials.
Fit with regulation
A CSMS under UN R155 should cover this unit through its risk assessment and monitoring. The TCU's role in updates ties it to the SUMS under R156 as well, since UL says updates must have their authenticity and integrity established.
A note on privacy
The TCU also handles location and usage data. A security review should include what is stored, how long, who can query it and how it is deleted. Data collected for car sharing or stolen vehicle recovery can be sensitive in the wrong hands, so treat access controls on the cloud side as part of the same review.
Quick check
Does a TCU need to write to the vehicle network?
Only if the product offers remote commands. Read only access reduces what a compromise can do.
Sources
Last reviewed: 19 October 2026.
