"The striking point is that technologies widely used in ordinary online services are now part of the automotive security landscape," software engineering researcher Srijita Basu, who works at both institutions, told ScienceAlert.
The wider network includes mobile and web applications and cloud services, which store or process data on remote computers.
Apps and cloud services linked to a car can store data on where it travels and how it is used, and sometimes data on its owner, Basu explained. Poor security could allow outsiders to access that data.
The consequences can also depend on connections within the vehicle. Basu noted that its entertainment and telematics systems, the software that logs and transmits data about how the car is running, can exchange data with other vehicle components.
"If a vulnerability is exploited and security boundaries between these systems and safety-critical functions are insufficient, an attacker may potentially progress beyond the initial component," Basu cautioned.
To investigate where weaknesses were concentrated, the researchers collected automotive-related records covering January 2022 through September 2024 from the US National Vulnerability Database, cross-checking additional security sources.
The flaws were categorized by the software affected, severity, and where they originated during software development.
They compared their findings with research covering 2010–2019. Applying the earlier study's method to the newer records also showed an increased share involving external software.
The team examined another way flaws can enter automotive software, through ready-made code components called libraries. Developers use these components to perform tasks without writing every function themselves.
Using five scanning tools, the researchers examined 20 open-source projects used in automotive software or its development. This separate investigation identified 827 vulnerable libraries.
The paper also identified libraries shared across projects. A weakness in one widely used component could therefore affect multiple systems.
Basu suggested manufacturers should know which components go into their software, regularly scan libraries obtained from other developers, watch for newly reported flaws, and have a plan for applying fixes.
