Security researchers disclosed critical authorization and access control vulnerabilities within Kia’s dealership management infrastructure, specifically the kiaconnect.kdealer.com web portal. The flaws permitted unauthenticated adversaries to abuse dealer registration workflows, mint valid administrative session tokens, and query backend telematics APIs. By resolving a target vehicle’s license plate to its Vehicle Identification Number (VIN) through external vehicle history lookups, attackers could invoke exposed dealer endpoints to extract sensitive owner PII—including full names, phone numbers, email addresses, and physical locations.

Attackers could then issue backend API calls to silently associate an attacker-controlled profile with the target VIN as a secondary owner without prompting or alerting the legitimate vehicle owner. Once bound, the adversary leveraged Kia Connect telematics gateways to transmit arbitrary commands—such as unlocking doors, remote engine ignition, sounding horns, and polling real-time GPS coordinates in under 30 seconds. Disclosed responsibly by researchers Sam Curry, Neiko Rivera, Justin Rhinehart, and Ian Carroll, the flaws affected millions of post-2013 internet-connected Kia models regardless of active subscription status. Kia addressed the server-side API flaws prior to public disclosure; no in-the-wild malicious exploitation was detected.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Broken B2B access controls in upstream dealer portals bypass vehicle-side cryptographic verifications, granting unauthorized remote CAN-bus telematics execution and silent persistence solely through license plate resolution without requiring vehicle interaction.
• Bullet 2 — Strategic & Defender Imperative: Automotive OEMs and IoT fleet operators must enforce strict zero-trust authentication on dealer activation gateways, isolate administrative provisioning APIs from public lookups, and implement mutual TLS and multi-factor authorization before binding remote vehicle controllers.