> ## Content Index
> Fetch the complete content index at: https://www.privacyguides.org/llms.txt
> Use this file to discover other available public pages before exploring further.

# Pwn2Own Automotive Shows How Insecure Our Vehicles Are
- URL: https://www.privacyguides.org/news/2026/01/23/pwn2own-automotive-shows-how-insecure-our-vehicles-are/
- Published: 2026-01-23T20:44:02.000Z
- Updated: 2026-01-23T20:44:02.000Z
- Description: The first day of the Pwn2Own Automotive hacking competition has kicked off in Tokyo, Japan, with “a record 73 entries” showing that our vehicles are juicier targets than ever.
- Author: Fria Reyes
- Tags: News Briefs

The first day of the [Pwn2Own](https://www.zerodayinitiative.com/blog/2026/1/20/pwn2own-automotive-2026-the-full-schedule) Automotive hacking competition has kicked off in Tokyo, Japan, with “a record 73 entries” showing that our vehicles are juicier targets than ever.

Competitors attacked infotainment systems and charging stations for electric vehicles, earning a total of $516,500 and exploiting 37 vulnerabilities. Among the victims were Tesla’s infotainment system, hacked by Synacktiv Team, who chained two zero-day vulnerabilities together to hack it. The results of day one have been [posted](https://www.zerodayinitiative.com/blog/2026/1/21/pwn2own-automotive-2026-day-one-results), complete with a leaderboard.

The contest takes place during the [Automotive World](https://www.automotiveworld.jp/tokyo/en-gb.html) exhibition, a show of the latest tech from auto manufacturers.

The contest, run by Zero Day Initiative, gives us a glimpse into just how vulnerable our vehicles are. Understandably, the focus is mainly on the infotainment system, but I was surprised to see multiple charging controllers also being hacked. You wouldn’t think the charging controller would be vulnerable but clearly that’s not the case.

The internal workings of a modern car are essentially a complex network of components talking to each other, all of which can be vulnerable to attack. The competition only focused on specific part of the vehicle, but imagine the damage that could be done if the competition was to hack a full car.

You don’t even necessarily need physical access to the car. A [vulnerability](https://samcurry.net/hacking-subaru) in Subaru’s STARLINK system (no not that one) allowed attackers to take control of a vehicle remotely via an exposed and vulnerable admin panel.

An attacker could remotely start, stop, unlock, and retrieve the current or previous complete location history of any vehicle, read information from the instruments on the car such as sales history, odometer reading, and previous owners, as well as access personally identifiable information such as emergency contacts, physical address, billing information, and the vehicle PIN. All without needing any kind of complex chain of exploits or physical access like the contestants had.

A similar remote [vulnerability](https://samcurry.net/hacking-kia) was found by the same researchers in Kia’s system that would allow an attacker to remotely start/stop, geolocate the vehicle, and remotely lock/unlock it, and even access the cameras on certain models with nothing more than the license plate. The vehicle didn’t even need an active Kia Connect subscription.

Vulnerabilities in cars have shot up sharply since around [2019](https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/rising-security-weaknesses-in-the-automotive-industry-and-what-it-can-do-on-the-road-ahead). Auto manufacturers have not caught up to the growing landscape of threats. The [2025](https://www.bleepingcomputer.com/news/security/hackers-get-886-250-for-49-zero-days-at-pwn2own-automotive-2025/) Pwn2Own competition ended with 49 vulnerabilities exploited, the same number as the [previous year](https://www.bleepingcomputer.com/news/security/pwn2own-automotive-13m-for-49-zero-days-tesla-hacked-twice/).

There are efforts to address the growing issue of cybersecurity in cars at least. ISO/SAE 21434 provides a standard of best cybersecurity practices for car manufacturers to adhere to. There is also work on [implementing](https://www.vector.com/int/en/products/products-a-z/embedded-software/microsar-hsm/) Secure Boot using Hardware Security Modules for cars, bringing improved security against malware persistence.

It seems to be too little, too late, however. We will have to wait and see if car manufacturers will start taking security seriously or just keep dumping more connected features into vehicles carelessly.