Infotainment, EV Charger Exploits Earn Hackers $1M at Pwn2Own Automotive 2026
Source SecurityWeek
Description
Pwn2Own participants disclosed a total of 76 vulnerabilities during the three-day event. The post Infotainment, EV Charger Exploits Earn Hackers $1M at Pwn2Own Automotive 2026 appeared first on SecurityWeek .
Impact
For European organizations, the disclosed vulnerabilities pose several risks. Automotive manufacturers and suppliers could face safety incidents if attackers exploit infotainment system flaws to interfere with vehicle operations or access sensitive data. EV charging infrastructure providers might experience service disruptions or unauthorized access, potentially affecting EV users and grid stability. Privacy concerns arise from potential data leakage through compromised infotainment systems. The reputational damage and regulatory consequences under frameworks like GDPR and the EU Cybersecurity Act could be significant if vulnerabilities lead to breaches. Additionally, the interconnected nature of automotive systems means that exploitation could cascade, impacting broader transportation networks and critical infrastructure. Given Europe's leadership in automotive manufacturing and rapid EV adoption, these threats could have widespread operational and economic impacts if not addressed promptly.
Defensive guidance
European organizations should implement a multi-layered security approach tailored to automotive and EV charging systems. This includes rigorous vulnerability scanning and penetration testing focused on infotainment and charging station software. Manufacturers must adopt secure development lifecycle practices, emphasizing code review, static and dynamic analysis, and fuzz testing to identify and remediate vulnerabilities early. Timely patch deployment is critical; organizations should establish rapid update mechanisms for vehicles and charging infrastructure. Network segmentation can limit attackers' lateral movement between infotainment systems and critical vehicle control units. Employing strong authentication and encryption protocols for communication between EV chargers and backend systems will reduce interception and tampering risks. Monitoring and anomaly detection systems should be enhanced to identify suspicious activities in real time. Collaboration with industry groups and sharing threat intelligence will help anticipate emerging threats. Finally, user awareness campaigns can reduce risks related to social engineering or physical access to vehicle systems.
Summary
The Pwn2Own Automotive 2026 competition revealed a total of 76 vulnerabilities across automotive infotainment systems and electric vehicle (EV) charging stations. These vulnerabilities were exploited by security researchers in a controlled environment to demonstrate potential attack vectors, earning them $1 million in total rewards. The disclosed flaws span a range of issues, likely including memory corruption, authentication bypasses, and insecure communication protocols, although specific technical details were not provided. Infotainment systems, which integrate navigation, media, and connectivity features, are increasingly complex and connected to vehicle control networks, making them attractive targets for attackers seeking to compromise vehicle safety or user data. Similarly, EV chargers are critical infrastructure components that, if compromised, could disrupt charging services or be leveraged as entry points into broader networks. While no active exploits have been observed in the wild, the vulnerabilities underscore the evolving threat landscape in automotive cybersecurity. The medium severity rating reflects the potential for significant impact balanced against the current lack of exploitation and the controlled disclosure setting. The event highlights the need for automotive manufacturers and infrastructure providers to enhance security testing, implement robust patch management, and adopt secure coding practices to mitigate these risks.