# Threats to Vehicle Over-the-Air (OTA) Update Infrastructure, Telematics and Aftermarket Devices (Kaspersky ICS CERT Report)

> Kaspersky ICS CERT's 15 October 2026 report analyzes threats to vehicle OTA update systems and the controls needed to protect them. It cites infrastructure compromise (the September 2025 Jaguar Land Rover ransomware attack) and researcher-demonstrated flaws in Subaru STARLINK, Spireon fleet systems, Telit Cinterion modems and ELD firmware (a 'Truck-to-Truck Worm' proof of concept). The report describes no widespread attacks on OTA mechanisms themselves.

- **Published:** 2026-10-16T02:35:02Z
- **Last reviewed:** 2026-10-16T02:35:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3698
- **ID:** TL-2026-3698
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-47610, CVE-2023-47611, CVE-2023-47612, CVE-2023-47613, CVE-2023-47614, CVE-2023-47615, CVE-2023-47616

## Description

Kaspersky ICS CERT (Sergey Melnikov, Stepan Rybakov) published a report on 2026-10-15 on the security of vehicle over-the-air (OTA/FOTA) update mechanisms. Modern vehicles contain more than 100 ECUs; the report notes that 309 models from 23 manufacturers offered OTA capability in the early 2020s, that 30-40% of the US/EU/China fleet is projected to be OTA-capable in the 2030s, and that update frequency is expected to rise from roughly 4-5 to 12-14 updates per year. Vehicles have a statutory service life of about 10 years but often stay on the road 15-20+ years, which lengthens the exposure of any update-chain weakness.

The report groups threats into several classes. (1) Infrastructure compromise: the September 2025 ransomware attack on Jaguar Land Rover disrupted manufacturing and supplier operations for several weeks, exposed corporate data, internal systems and vehicle technical documentation, put several suppliers at risk of bankruptcy, and affected roughly 5,000 organizations, with total UK economic losses cited at about $2.5 billion and additional secured loans of $4.69 billion. (2) Digital-service exploitation: in November 2024 researchers Sam Curry and Shubham Shah reached the Subaru STARLINK admin panel by abusing a password-reset flaw that required no confirmation token and a client-side-only two-factor check, which exposed vehicle location history, VINs, owner PII and remote lock/unlock/start/stop functions in the US, Canada and Japan. Subaru fixed it within 24 hours. (3) Fleet telematics: in January 2023 Sam Curry and colleagues reported Spireon vulnerabilities (SQL injection and related flaws giving administrator access to GoldStar, LoJack, FleetLocate, nSpire and Trailer & Asset panels) affecting about 15.5 million vehicles, including police and ambulance fleets, with command, tracking and firmware-update capability. (4) Aftermarket devices: Colorado State University researchers (Jake Jepson, Rik Chatterjee, Jeremy Daily; NDSS VehicleSec 2024 and DEF CON 32) showed that Electronic Logging Devices with predictable SSIDs, default passwords and exposed firmware-update APIs could be reflashed wirelessly. Modified firmware altered the engine air-fuel mixture and slowed a truck. A 'Truck-to-Truck Worm' PoC propagated between ELDs over about 36 meters in under 30 seconds (demonstrated on ESP32 boards in a controlled setting). (5) Embedded modems: Kaspersky ICS CERT's May 2024 research on Telit Cinterion modems (also cited in the report in the context of ERA-GLONASS emergency units) disclosed CVE-2023-47610 (heap overflow in SUPL message handling, RCE via crafted SMS, no authentication) and six further local flaws (CVE-2023-47611 to CVE-2023-47616), allowing arbitrary code execution and a possible pivot toward vehicle ECUs.

The report also lists OTA-specific attack vectors: physical and side-channel key extraction, bootloader exploitation, replay of update commands, rollback to vulnerable firmware, and tampering with configuration parameters. Recommended controls include a hardware root of trust (TPM/HSM), TLS with X.509 backend authentication, private APNs, signed updates with MAC/signature verification and anti-replay timestamps, strict anti-rollback version checks, secure boot chains, disabled or authenticated JTAG/SWD, fault-injection countermeasures (lockstep cores, CFI, watchdogs), cryptographically chained logs, SBOM and RxSWIN registry management under UN Regulation No. 155 (cybersecurity management), UN Regulation No. 156 (software update management) and ISO 24089:2023.

This record is a monitoring-level synthesis of a single primary report plus the underlying public research. No CVE-tracked OTA-platform flaw, named threat actor or widespread in-the-wild exploitation of OTA mechanisms is reported. The JLR attack was publicly claimed by a Scattered Spider-affiliated collective according to press reporting, not by the Kaspersky report. No network IOCs are published in the report, so BeaconBeagle correlation was not applicable.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1542 Pre-OS Boot
- T1111 Multi-Factor Authentication Interception
- T1565.001 Stored Data Manipulation

## Sources

- [Cybersecurity of over-the-air update mechanisms for vehicles (Kaspersky ICS CERT)](https://ics-cert.kaspersky.com/publications/reports/2026/10/15/cybersecurity-of-over-the-air-update-mechanisms-for-vehicles/)
- [Telit Cinterion modem vulnerabilities (Kaspersky blog)](https://www.kaspersky.com/blog/telit-cinterion-m2m-modems-vulnerabilities/51237/)
- [Kaspersky identifies significant security risks in widely used Cinterion modems](https://www.kaspersky.com/about/press-releases/kaspersky-identifies-significant-security-risks-in-widely-used-cinterion-modems)
- [Subaru STARLINK vulnerability exposed cars to remote hacking (SecurityWeek)](https://www.securityweek.com/subaru-starlink-vulnerability-exposed-cars-to-remote-hacking/)
- [Telematics research includes significant Spireon findings (NMFTA)](https://nmfta.org/news/telematics-research-includes-significant-spireon-findings/)
- [Cybersecurity vulnerabilities in electronic logging devices (NDSS VehicleSec 2024)](https://www.ndss-symposium.org/wp-content/uploads/vehiclesec2024-47-paper.pdf)
- [Compromising an Electronic Logging Device and Creating a Truck2Truck Worm (DEF CON 32)](https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20video%20and%20slides/DEF%20CON%2032%20video%20and%20slides%20captions/DEF%20CON%2032%20-%20Compromising%20an%20Electronic%20Logging%20Device%20and%20Creating%20a%20Truck2Truck%20Worm%20-%20Jake%20Jepson%2C%20Rik%20Chatterjee.eng.text)
- [Cyberattack disrupts Jaguar Land Rover operations (INCIBE-CERT)](https://www.incibe.es/index.php/en/incibe-cert/publications/cybersecurity-highlights/cyberattack-disrupts-jaguar-land-rover-operations)
- [Jaguar Land Rover will extend its production halt into a third week (Security Affairs)](https://securityaffairs.com/?p=182312)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3698