Security Analysis: Total Compromise of the Volvo/Eicher Fleet Management Ecosystem

Author: Eaton
Date: July 27, 2026

Executive Summary

VE Commercial Vehicles (VECV)—a strategic joint venture between Eicher Motors and the Volvo Group—operates a specialized fleet management system known as My Eicher. This platform is tailored for the Indian commercial vehicle market, providing owners and operators with high-level telematics.

"My Eicher is a complete fleet management vehicle GPS tracking system designed for commercial vehicle owners, fleet managers, operators. With our highly advanced telematics platform, you can take control of your fleet like never before."

A critical security flaw was identified within the platform's APIs, allowing an attacker to uncover hidden, unauthenticated administrative endpoints. These vulnerabilities facilitated full account takeovers, granting unauthorized control over massive fleets of vehicles and exposing sensitive personal data.

---

The Scale of Exposure

While official figures from November 2024 cited 275,000 vehicles and 115,000 customers, the data extracted via the vulnerable APIs suggested a much larger footprint.

Data Discrepancy Table

---

The Path to Discovery

The researcher's journey began with a failed attempt in early 2024 (around the time of the Toyota insurance hack). Initial 2024 attempt: Unsuccessful. However, in 2025, a breakthrough occurred.

The Technical "Luck"

The discovery started with a standard API used for mobile number validation: https://www.myeicher.in/cepauthmgr/user/validateMobileNo

By simply "walking up" the directory tree—a process that usually fails in $P(\text{success}) \approx 0.01$ of cases—the researcher accessed the base endpoint: https://www.myeicher.in/cepauthmgr/user/

Instead of a 404 or 403 error, the server returned a comprehensive directory of all user-related APIs. This included endpoints for "customers," "users," and "persons," some of which leaked plain-text passwords.

---

Weaponizing the OTP System

The most severe vulnerability involved the One-Time Password (OTP) mechanism. The researcher discovered an API that leaked a historical archive of 2.5 million OTPs dating back to 2021. Furthermore, specific APIs allowed for the retrieval of current OTPs linked to any mobile number.

Attack Vector Workflow:

• Step 1: Identify the target user's mobile number via the leaked customer list.
• Step 2: Query the OTP API using that specific mobile number to retrieve the active code.
• Step 3: Enter the stolen OTP into the login portal to bypass authentication.

Note: This method is not "silent," as the legitimate user still receives the OTP via SMS. However, an attacker could subsequently use password-update APIs to lock the user out and maintain persistent access.

---

System Capabilities & Data Leakage

Once inside, the attacker gained the same privileges as a fleet manager. This included:

• Real-time GPS Tracking: Monitoring the exact location of all vehicles in a fleet.
• Live Telematics: Viewing the vehicle's gauge cluster (mirroring the driver's view).
• Geofencing: Setting and monitoring virtual boundaries for vehicles.

Visual Evidence of Access

Fleet Tracking Map

Individual Vehicle Details

Live Driver Cluster View

The Document Leak

Beyond vehicle control, the breach exposed 76,000 uploaded documents. This included highly sensitive PII (Personally Identifiable Information) such as:

1. Aadhaar Cards (Indian National ID)
2. Driving Licenses

---

Disclosure Timeline

Following the initial patch, the researcher attempted to report further concerns through general customer support channels, but these were ignored by the company.