Default admin:admin password lets researchers take over two automakers' cars

Tier D · Background noise – Good to know

Who’s exposed: Customers of two automakers with connected cars

Tier D because: Does not hit tech teams

Reach

Attack

Damage

Fix

Full takeover

The Brief

Two security researchers found that the login systems behind two car brands' mobile apps could be taken over completely.
The servers were reachable with the default 'admin:admin' credentials.
An attacker could access any customer's account and, for a connected car, unlock the doors and start the engine.

Why it matters

Default credentials on backend systems can expose every customer account and the remote vehicle controls tied to them, so any service built with default logins is at risk.

The checklist behind the tier

Checklist · 1 of 10 yes

No	Hits tech teams	Judgment: consumer car-app login backend run by automakers for their own customers, not a developer-facing service.
No	Core infrastructure	Judgment: a pair of automakers' app backends, not software nearly every team runs.
No	Popular tool	Judgment: automaker-specific backend servers, not a widely used framework, tool, platform or package.
No	Exploited in the wild	The Hacker News: researchers found the flaw; no observed attacks reported.
No	Public exploit	The Hacker News: no source says exploit code or a step-by-step PoC is published.
No	Remote, no login	The Hacker News: takeover relies on default admin:admin credentials, so an attacker needs valid login details.
Yes	Full takeover	The Hacker News: login systems could be taken over completely, allowing access to any customer's account and starting engines.
No	Secrets exposed	The Hacker News: researchers showed access was possible; no source says data was stolen or exposed.
No	Supply chain	The Hacker News: no legitimate package, update, pipeline or signing key is described as compromised.
No	No fix yet	The Hacker News: no source states whether a patch or password change has been shipped.

Source

Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars ↗ The Hacker News · 2h ago

First seen 2h ago · 1 source · Full story page · How tiers are decided