Unauthenticated My Eicher APIs expose 750k Indian fleet customers, enabling total vehicle takeover
A flaw in VE Commercial Vehicles' My Eicher telematics platform lets anyone query internal admin endpoints without authentication, dumping data on over 750 k customers, 176 k users and 676 k vehicles. Exploiting these APIs grants full account takeover, letting an attacker control entire commercial fleets across India.