Modern vehicles increasingly receive software updates in the same way smartphones and computers do. An automaker can remotely fix bugs, add features, adjust charging behavior or patch a security vulnerability without requiring the owner to visit a dealership.
That convenience also creates a potentially powerful attack route.
An over-the-air update system connects the manufacturer’s cloud infrastructure, communication networks, vehicle software and dozens of electronic control units. If an attacker compromises any important part of that chain, a malicious update could potentially reach many vehicles at once.
The update is not automatically the danger. In fact, secure updates are essential for fixing vulnerabilities after a car leaves the factory. The risk comes from the enormous trust placed in the mechanism delivering them.
Cars Are Becoming Software Platforms
A modern connected vehicle is no longer controlled only by mechanical parts and a few isolated computers. Its software may manage braking assistance, steering support, battery charging, cabin controls, navigation, infotainment, digital keys and communication with mobile applications.
Research examining automotive vulnerabilities between 2018 and September 2024 identified 1,663 reported software vulnerabilities across the wider automotive ecosystem. The study found that vehicle software now extends beyond embedded controllers into cloud platforms, mobile applications, web services and infotainment systems.
This broader architecture makes vehicles more capable, but it also gives attackers more possible entry points.
A weakness in a mobile application may expose account access. A compromised cloud service could affect remote commands. Vulnerable third-party software might create a path into the vehicle’s network. The update system then becomes especially sensitive because it has permission to install trusted code.
A 2025 survey of software-defined vehicles concluded that their continuous connectivity and dependence on outsourced applications and over-the-air updates create a broader attack surface than traditional vehicle designs.
Why Over-the-Air Updates Are So Valuable
Without remote updates, repairing a software flaw may require hundreds of thousands of drivers to schedule dealership appointments.
The 2015 Jeep Cherokee cybersecurity case demonstrated the limitation of that approach. Fiat Chrysler recalled approximately 1.4 million vehicles and distributed a security patch through dealerships and USB drives after researchers remotely demonstrated control over important vehicle functions. Tesla, by comparison, could issue security fixes directly to affected cars through its update system.
Over-the-air updates can shorten the time between discovering a flaw and protecting vehicles. They can also correct battery-management problems, improve navigation, update driver-assistance software and reduce the cost of traditional recalls.
The National Highway Traffic Safety Administration’s vehicle cybersecurity guidance recognizes that advanced vehicles depend on electronics, sensors and computers and says manufacturers must design those systems to mitigate safety risks.
The problem is that the same route used to deliver a legitimate security patch could become extremely damaging if it were hijacked.
A Compromised Update Could Reach an Entire Fleet
A local vehicle attack may affect one car. A compromised update server could affect thousands or potentially millions.
An attacker might attempt to steal the manufacturer’s signing keys, penetrate a supplier’s development environment, alter code during production or compromise the cloud infrastructure responsible for distributing updates.
If the vehicle accepts the malicious package as genuine, it could install code with extensive privileges.
The possible effects depend on the system involved. A malicious update could disable features, collect location information, access microphones or cameras, interfere with charging or create a denial-of-service condition that prevents the vehicle from operating normally.
Direct control of braking or steering would be more difficult because safety-critical systems are usually separated from entertainment and external communication networks. However, poor network segmentation or a chain of several vulnerabilities could allow an attacker to move deeper into the vehicle.
Research into software-defined vehicles identifies third-party software, application programming interfaces, supply-chain compromises and OTA systems as important cybersecurity concerns requiring multilayered protection.
The Manufacturer’s Digital Signature Is Critical
Secure update systems usually rely on cryptographic signatures.
Before releasing an update, the automaker signs the software using a protected digital key. The vehicle verifies that signature before installation. If the file has been altered or comes from an unauthorized source, the verification should fail.
This process creates a chain of trust from the manufacturer to the vehicle’s individual electronic controllers.
The protection is only as strong as the security around the signing keys and build systems. If attackers steal a valid key or compromise the system that prepares official releases, they may be able to make malicious software appear legitimate.
Manufacturers must therefore protect code-signing infrastructure with strict access controls, hardware security modules, audit records and separation between development and release environments.
Vehicles should also reject older vulnerable software through rollback protection. Otherwise, an attacker could install a legitimate but outdated version containing a known security weakness.
Updates Can Fail Without Any Hacker Involvement
Cyberattacks are not the only concern.
A poorly tested update can create problems even when it comes directly from the manufacturer. Software may behave differently across trim levels, battery types, hardware revisions or regional configurations.
A failed installation could leave a vehicle unable to start, charge or use important features. In less serious cases, an update might cause infotainment crashes, inaccurate displays, excessive battery drain or communication problems.
This is why manufacturers often release updates gradually rather than sending them to every vehicle simultaneously. A small group receives the update first, allowing the company to detect unexpected problems before expanding distribution.
A safe update system also needs a recovery method. The vehicle may retain two software partitions so it can return to the previous version when the new one fails. Critical controllers should be able to enter a secure recovery state instead of becoming permanently unusable.
Suppliers Make the Update Chain More Complicated
Automakers rarely write every line of software themselves.
A vehicle may contain code from chip companies, mapping providers, infotainment developers, battery suppliers and dozens of other contractors. Some components also depend on open-source software maintained outside the automotive industry.
This creates a supply-chain problem. A manufacturer must understand not only its own code but also the libraries, tools and dependencies supplied by other organizations.
One compromised supplier could introduce malicious or vulnerable code into a legitimate product. The problem becomes harder when the vehicle contains old software whose original developer no longer supports it.
Connected cars can contain extremely large codebases sourced from suppliers across several countries. This complexity has complicated U.S. efforts to restrict software linked to China because automakers must determine where code originated and whether suppliers continue modifying it after production.
A detailed software bill of materials can help identify which vehicles contain a vulnerable component. Without that inventory, an automaker may struggle to determine the affected models after a new security flaw is disclosed.
Remote Access Creates National-Security Concerns
The issue extends beyond criminal hackers.
Connected vehicles collect location data, driving patterns, camera footage, microphone input and information from paired smartphones. A remote service with broad access could theoretically become a surveillance tool or a way to disrupt transportation.
Norwegian transport operator Ruter strengthened its cybersecurity controls after testing found that the manufacturer of certain Chinese-made electric buses retained remote access for software updates and diagnostics. Investigators said the access could theoretically be used to stop the buses, although no such incident had occurred.
The concern is not limited to vehicles from one country. Any connected vehicle with remote management creates questions about who controls the servers, where data is stored and what would happen if the manufacturer, supplier or cloud platform were compromised.
Governments are responding with stricter rules for software-defined vehicles, including requirements covering cybersecurity management and controlled software updates.
New Regulations Require Secure Update Processes
United Nations Regulation No. 156 establishes requirements for vehicle software updates and the systems manufacturers use to manage them. It focuses on controlled update processes, identifying software versions and ensuring that changes do not compromise safety or regulatory compliance.
A related framework, UN Regulation No. 155, requires manufacturers to operate a cybersecurity management system across the vehicle lifecycle.
ISO/SAE 21434 provides engineering guidance for identifying and controlling cybersecurity risks during vehicle design, development, production, operation, maintenance and decommissioning.
These rules matter because vehicle security cannot end when production finishes. A car may remain on the road for 15 or 20 years, while software vulnerabilities continue to be discovered long after its original developers move to another project.
An automaker must therefore maintain update infrastructure, security monitoring and incident-response capabilities for an extended period.
Owners Should Install Updates, Not Avoid Them
The possibility of a compromised update does not mean drivers should refuse every software release.
Ignoring updates can leave known vulnerabilities uncorrected. Criminals often target weaknesses after patches become available because the patch reveals what needed fixing.
Owners should install updates through the vehicle’s built-in system or an authorized dealership rather than downloading files from unofficial websites or social-media links.
A legitimate update should not require the driver to provide banking information, disclose a password through an unsolicited message or install software from an unknown USB device.
Drivers should also protect the online account connected to the vehicle. A strong unique password and multifactor authentication can reduce the risk of someone accessing remote lock, location or climate-control features.
Public Wi-Fi should be used cautiously, particularly when the vehicle or companion application performs account authentication over an unfamiliar network.
Automakers Need More Than Encryption
Encryption protects an update while it travels between the server and vehicle, but it does not solve every problem.
The manufacturer must secure the software development environment, protect signing keys, monitor supplier activity and test updates across many hardware configurations.
The vehicle itself needs network segmentation so a compromised infotainment system cannot easily reach braking, steering or battery controls. Critical commands should require additional verification rather than trusting every component inside the vehicle network.
Manufacturers should also monitor fleets for abnormal behavior after updates. A sudden rise in communication failures, unusual diagnostic activity or repeated installation errors may reveal a compromised package or hidden software defect.
Security must continue after the update is installed. Vulnerability-reporting programs, independent testing and coordinated disclosure allow researchers to report flaws before criminals exploit them.
The Update System Is Both the Defense and the Risk
Over-the-air updates are one of the strongest tools available for protecting connected cars. They allow manufacturers to correct vulnerabilities quickly and improve vehicles after purchase.
They are also one of the most attractive targets in the automotive ecosystem.
A successful attack against one vehicle may have limited reach. A successful attack against the system trusted to update an entire fleet could create damage at unprecedented scale.
The future of vehicle security therefore depends on treating software updates as safety-critical infrastructure. Authentication, digital signatures, supplier controls, rollback protection and long-term support must be designed with the same seriousness given to brakes, steering and airbags.
The next software update could fix the biggest security weakness in a vehicle. If the update system itself is not protected, it could also become the weakness that matters most.
