They could also view vehicle location, mileage, fuel level, range, and door status for accounts they did not own, according to the researchers' disclosure and corroborating reports.
That console still accepted the credentials admin:admin , according to the researchers' disclosure.
That access allowed them to generate valid sessions and exchange those for mobile-application authentication tokens that vehicle APIs accepted as legitimate.
In at least one Australian deployment, MFA was misconfigured in a way that allowed researchers to bypass it, simplifying account impersonation further.
Geographic Scope, Unnamed Brands The researchers withheld both automakers' identities in their public disclosure.