Threat reportVulnerabilityTL-2026-3698
Threats to Vehicle Over-the-Air (OTA) Update Infrastructure, Telematics and Aftermarket Devices (Kaspersky ICS CERT Report)
Threats to Vehicle Over-the-Air (OTA) Update Infrastructure (TL-2026-3698), also tracked as Truck-to-Truck Worm, is a medium-severity software vulnerability, first published 2026-10-16. It has no confirmed attribution, affects Subaru STARLINK connected-vehicle service (admin portal), references 7 CVEs (CVE-2023-47610, CVE-2023-47611, CVE-2023-47612), maps to 6 MITRE ATT&CK techniques (T1078, T1111, T1190), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 7Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-3698
- Threat ID
- TL-2026-3698
- Also known as
- Truck-to-Truck Worm, Truck2Truck Worm, Vehicle OTA Update Security
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- automotive, transport, logistics, telecoms, emergency-services, manufacturing
- Target regions
- North America, Europe, Asia, Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Threats to Vehicle Over-the-Air (OTA) Update Infrastructure
Malware and tooling: Computrace, Truck-to-Truck Worm, ESP32 development board
How Threats to Vehicle Over-the-Air (OTA) Update Infrastructure works
Kaspersky ICS CERT's 15 October 2026 report analyzes threats to vehicle OTA update systems and the controls needed to protect them. It cites infrastructure compromise (the September 2025 Jaguar Land Rover ransomware attack) and researcher-demonstrated flaws in Subaru STARLINK, Spireon fleet systems, Telit Cinterion modems and ELD firmware (a 'Truck-to-Truck Worm' proof of concept). The report describes no widespread attacks on OTA mechanisms themselves.
Kaspersky ICS CERT (Sergey Melnikov, Stepan Rybakov) published a report on 2026-10-15 on the security of vehicle over-the-air (OTA/FOTA) update mechanisms. Modern vehicles contain more than 100 ECUs; the report notes that 309 models from 23 manufacturers offered OTA capability in the early 2020s, that 30-40% of the US/EU/China fleet is projected to be OTA-capable in the 2030s, and that update frequency is expected to rise from roughly 4-5 to 12-14 updates per year. Vehicles have a statutory service life of about 10 years but often stay on the road 15-20+ years, which lengthens the exposure of any update-chain weakness.
The report groups threats into several classes. (1) Infrastructure compromise: the September 2025 ransomware attack on Jaguar Land Rover disrupted manufacturing and supplier operations for several weeks, exposed corporate data, internal systems and vehicle technical documentation, put several suppliers at risk of bankruptcy, and affected roughly 5,000 organizations, with total UK economic losses cited at about $2.5 billion and additional secured loans of $4.69 billion. (2) Digital-service exploitation: in November 2024 researchers Sam Curry and Shubham Shah reached the Subaru STARLINK admin panel by abusing a password-reset flaw that required no confirmation token and a client-side-only two-factor check, which exposed vehicle location history, VINs, owner PII and remote lock/unlock/start/stop functions in the US, Canada and Japan. Subaru fixed it within 24 hours. (3) Fleet telematics: in January 2023 Sam Curry and colleagues reported Spireon vulnerabilities (SQL injection and related flaws giving administrator access to GoldStar, LoJack, FleetLocate, nSpire and Trailer & Asset panels) affecting about 15.5 million vehicles, including police and ambulance fleets, with command, tracking and firmware-update capability. (4) Aftermarket devices: Colorado State University researchers (Jake Jepson, Rik Chatterjee, Jeremy Daily; NDSS VehicleSec 2024 and DEF CON 32) showed that Electronic Logging Devices with predictable SSIDs, default passwords and exposed firmware-update APIs could be reflashed wirelessly. Modified firmware altered the engine air-fuel mixture and slowed a truck. A 'Truck-to-Truck Worm' PoC propagated between ELDs over about 36 meters in under 30 seconds (demonstrated on ESP32 boards in a controlled setting). (5) Embedded modems: Kaspersky ICS CERT's May 2024 research on Telit Cinterion modems (also cited in the report in the context of ERA-GLONASS emergency units) disclosed CVE-2023-47610 (heap overflow in SUPL message handling, RCE via crafted SMS, no authentication) and six further local flaws (CVE-2023-47611 to CVE-2023-47616), allowing arbitrary code execution and a possible pivot toward vehicle ECUs.
The report also lists OTA-specific attack vectors: physical and side-channel key extraction, bootloader exploitation, replay of update commands, rollback to vulnerable firmware, and tampering with configuration parameters. Recommended controls include a hardware root of trust (TPM/HSM), TLS with X.509 backend authentication, private APNs, signed updates with MAC/signature verification and anti-replay timestamps, strict anti-rollback version checks, secure boot chains, disabled or authenticated JTAG/SWD, fault-injection countermeasures (lockstep cores, CFI, watchdogs), cryptographically chained logs, SBOM and RxSWIN registry management under UN Regulation No. 155 (cybersecurity management), UN Regulation No. 156 (software update management) and ISO 24089:2023.
This record is a monitoring-level synthesis of a single primary report plus the underlying public research. No CVE-tracked OTA-platform flaw, named threat actor or widespread in-the-wild exploitation of OTA mechanisms is reported. The JLR attack was publicly claimed by a Scattered Spider-affiliated collective according to press reporting, not by the Kaspersky report. No network IOCs are published in the report, so BeaconBeagle correlation was not applicable.
MITRE ATT&CK techniques used in TL-2026-3698
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Credential Access
T1111 Multi-Factor Authentication Interception
Persistence
Impact
T1565.001 Stored Data Manipulation
Reconnaissance
Affected products and versions in Threats to Vehicle Over-the-Air (OTA) Update Infrastructure
- Subaru — STARLINK connected-vehicle service (admin portal)
Vulnerable versions: Service as of 2024-11-20
Fixed in: Fixed within 24 hours of report - Spireon — GoldStar, LoJack, FleetLocate, nSpire, Trailer & Asset admin panels
Vulnerable versions: As of January 2023 disclosure
Fixed in: Not confirmed in sources - Telit Cinterion — Cinterion BGS5, EHS5/6/8, PDS5/6/8, ELS61/81, PLS62 modems
Vulnerable versions: Firmware per KLCERT-22-193..216, KLCERT-23-018
Fixed in: Not stated in sources - Various — Aftermarket Electronic Logging Devices (ELDs) tested by Colorado State University
Vulnerable versions: Tested ELD firmware with default credentials and exposed update API
Fixed in: Not stated in sources - Jaguar Land Rover — Corporate and manufacturing IT (September 2025 ransomware incident)
Vulnerable versions: N/A - incident
Fixed in: Systems restored after weeks-long shutdown
Remediation for Threats to Vehicle Over-the-Air (OTA) Update Infrastructure
Patches
- Apply Telit Cinterion firmware updates where available for CVE-2023-47610 through CVE-2023-47616 (affected: BGS5, EHS5/6/8, PDS5/6/8, ELS61/81, PLS62)
- Subaru fixed the STARLINK admin panel flaw within 24 hours of the 2024-11-20 report
Immediate actions
- Inventory telematics control units, aftermarket ELDs/GPS trackers and cellular modems in vehicles and fleets and change default Wi-Fi SSIDs and passwords
- Disable SMS delivery or SUPL handling on embedded cellular modems where not required and move devices to private APNs
- Enforce MFA server-side and remove client-side-only access controls on telematics and connected-car admin portals
- Ask fleet telematics suppliers (e.g. Spireon products) to confirm fixes for the reported administrator-access flaws
Workarounds
- Restrict physical access to telematics and modem hardware
- Enforce application signature verification on modems
- Isolate aftermarket devices from the vehicle CAN bus gateway where possible
Longer-term hardening
- Implement a hardware root of trust (TPM/HSM) with secure boot and a verified chain of trust for every ECU and modem
- Sign all update packages, verify timestamps against replay, and enforce anti-rollback with strictly increasing version numbers
- Use TLS with X.509 backend authentication and keep backend update infrastructure segmented from corporate IT to limit ransomware blast radius
- Disable or authenticate JTAG/SWD debug interfaces and add fault-injection countermeasures
- Maintain SBOMs and an RxSWIN registry per UN R156 and a CSMS per UN R155; align with ISO 24089:2023
- Keep cryptographically chained update logs and feed them to SOC/anomaly detection
CVEs associated with Threats to Vehicle Over-the-Air (OTA) Update Infrastructure
CVE-2023-47610, CVE-2023-47611, CVE-2023-47612, CVE-2023-47613, CVE-2023-47614, CVE-2023-47615, CVE-2023-47616
Weaknesses (CWE) in Threats to Vehicle Over-the-Air (OTA) Update Infrastructure
Timeline of Threats to Vehicle Over-the-Air (OTA) Update Infrastructure
- January 2023 (day not stated in sources): Sam Curry and colleagues disclose Spireon fleet telematics flaws giving administrator access to panels covering about 15.5 million vehicles; NMFTA later notes the flaws were not confirmed fixed.
- February 2024 (day not stated in sources): Colorado State University publishes ELD vulnerabilities and the Truck-to-Truck Worm design at NDSS VehicleSec 2024.
- Kaspersky ICS CERT discloses seven Telit Cinterion modem vulnerabilities (CVE-2023-47610 to CVE-2023-47616), including SMS-triggered RCE.
- August 2024 (DEF CON 32; exact day not verified): Jake Jepson and Rik Chatterjee present the ELD compromise and Truck2Truck worm.
- Sam Curry and Shubham Shah report the Subaru STARLINK admin panel takeover flaw; Subaru fixes it within 24 hours.
- Jaguar Land Rover announces a cyberattack that shuts factories in the UK, China, Slovakia and India; a data breach is confirmed on 2025-09-10.
- JLR extends its production shutdown until 2025-09-24 while systems are restored.
- Kaspersky ICS CERT publishes its report on cybersecurity of OTA update mechanisms for vehicles.
Sources cited for Threats to Vehicle Over-the-Air (OTA) Update Infrastructure
- Cybersecurity of over-the-air update mechanisms for vehicles (Kaspersky ICS CERT)
- Telit Cinterion modem vulnerabilities (Kaspersky blog)
- Kaspersky identifies significant security risks in widely used Cinterion modems
- Subaru STARLINK vulnerability exposed cars to remote hacking (SecurityWeek)
- Telematics research includes significant Spireon findings (NMFTA)
- Cybersecurity vulnerabilities in electronic logging devices (NDSS VehicleSec 2024)
- Compromising an Electronic Logging Device and Creating a Truck2Truck Worm (DEF CON 32)
- Cyberattack disrupts Jaguar Land Rover operations (INCIBE-CERT)
- Jaguar Land Rover will extend its production halt into a third week (Security Affairs)
Detection coverage for TL-2026-3698
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3698 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.