NewsPublished 16 Oct 2025

Zero Day Initiative — Pwn2Own Automotive Returns to Tokyo with Expanded Chargers and More!

Source Reddit InfoSec News

Description

The Zero Day Initiative (ZDI) announced the return of its Pwn2Own Automotive hacking competition in Tokyo, featuring expanded targets including automotive chargers and other vehicle-related technologies. This event focuses on identifying zero-day vulnerabilities in automotive systems by incentivizing security researchers to discover and responsibly disclose critical flaws. While no specific vulnerabilities or exploits have been disclosed yet, the competition highlights the increasing cybersecurity risks in connected vehicles and their infrastructure. European automotive manufacturers and suppliers, heavily invested in connected and electric vehicle technologies, could be indirectly impacted by vulnerabilities discovered through this initiative. The event underscores the importance of proactive vulnerability management and collaboration between researchers and industry to mitigate emerging threats. Organizations should monitor disclosures resulting from Pwn2Own and prepare to apply patches promptly. Given the critical nature of automotive system security and the potential for remote exploitation, the suggested severity is high. Defenders should prioritize threat intelligence integration and strengthen security controls around vehicle communication interfaces and charging infrastructure.

Impact

For European organizations, the potential impact of vulnerabilities discovered through the Pwn2Own Automotive competition is significant. Europe is home to major automotive manufacturers and suppliers who are leaders in connected and electric vehicle technologies. Vulnerabilities in vehicle systems or charging infrastructure could lead to unauthorized remote control of vehicles, data breaches involving sensitive user or operational data, or disruption of charging services. Such incidents could result in safety risks, financial losses, reputational damage, and regulatory penalties under frameworks like GDPR and the EU Cybersecurity Act. The interconnected nature of automotive supply chains means that a vulnerability in one component could cascade across multiple manufacturers and service providers. Additionally, critical infrastructure supporting electric vehicle charging networks in Europe could be targeted, affecting availability and trust in green transportation initiatives. The competition’s focus on zero-day vulnerabilities means that these flaws are unknown to vendors prior to disclosure, increasing the risk window. However, the responsible disclosure model employed by ZDI helps mitigate long-term impact by enabling timely patching. European organizations must therefore be vigilant in monitoring disclosures, assessing their exposure, and deploying mitigations rapidly to reduce risk.

Defensive guidance

European organizations should adopt a multi-layered approach to mitigate risks associated with vulnerabilities identified through Pwn2Own Automotive. First, establish active threat intelligence monitoring to track disclosures from the competition and related sources. Second, implement rigorous vulnerability management processes to rapidly assess and deploy patches or mitigations once vulnerabilities are disclosed. Third, enhance network segmentation and access controls around vehicle communication interfaces, charging stations, and backend systems to limit lateral movement in case of compromise. Fourth, conduct regular security assessments and penetration testing focused on automotive systems and charging infrastructure to identify weaknesses proactively. Fifth, collaborate closely with suppliers and partners to ensure security standards and timely information sharing across the supply chain. Sixth, invest in anomaly detection and incident response capabilities tailored to automotive environments to detect and respond to suspicious activities quickly. Finally, participate in industry information sharing groups and standards bodies to stay aligned with emerging best practices and regulatory requirements specific to automotive cybersecurity.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Oct 2025, 17:15 UTC

Technical details

References

Community reviews