Kia dealer-portal flaw lets anyone register as a dealer and remotely control cars by license plate, disclosed September 2024

Changes to what this case says, with the reason. Every earlier version is kept.

• 2026-10-21: Controls: c-i4. Editor's classification call of 21 october 2026 (call 17, accepted from pull request #74): restores the owner-notification control removed on 14 october 2026 under verifier rule 10, now that a linked source states it was absent: curry and others, 'hacking kia': 'from the victim's side, there was no notification that their vehicle had been accessed nor their access permissions modified.' mapped to warnings designed as alerts (c-i4) at medium confidence rather than kept as an unmapped candidate.
  Show the change

  Before:

  After: {"bucket": "absent", "id": "C-I4", "note": "Owner notification on access changes: the researchers write that, from the victim's side, there was no notification that the vehicle had been accessed or its access permissions modified", "confidence": "medium", "basis": "curated"}
• 2026-10-20: Sources: *: checked. Found in the editor's source re-check of 19-20 october 2026: every cited source re-opened and read in this re-check.
  Show the change

  Before: 2026-10-13

  After: 2026-10-20
• 2026-10-20: Sources: curry: date. Found in the editor's source re-check of 19-20 october 2026: the write-up is headed 'september 20, 2024', but its own timeline says '09/26/24 08:15 am utc - disclosed vulnerability publicly', and wired reported the disclosure as 'today' on 26 september 2024. the page heading is kept in a date note.
  Show the change

  Before: 2024-09-20

  After: 2024-09-26
• 2026-10-20: Inference: source ids. Found in the editor's source re-check of 19-20 october 2026: the added sentence on the differing fix accounts rests on wired (26 september 2024) as well as the researchers' write-up.
  Show the change

  Before: ["CURRY"]

  After: ["CURRY", "WIRED"]
• 2026-10-20: Inference: value. Found in the editor's source re-check of 19-20 october 2026: the interpretation did not say what the record does not show (rule 17). neither the researchers' write-up (curry) nor wired describes the change made to the backend, and the two give different accounts of the fix's timing (june change and august 'permanent fix' still in progress, per wired; remediation reported on 14 august 2024, per the researchers). the interpretation was already unsigned; the editor signs the new wording.
  Show the change

  Before: The vehicle did nothing wrong: it obeyed a valid command. The failure was in the backend, in who could get a dealer credential and how much authority that credential carried. That is why a case where the car decided nothing belongs in a register of autonomous action

  After: The vehicle did nothing wrong: it obeyed a valid command. The failure was in the backend, in who could get a dealer credential and how much authority that credential carried. That is why a case where the car decided nothing belongs in a register of autonomous action. The record does not say what was changed in the backend to fix it, and the accounts of when it was fixed differ
• 2026-10-20: Fields: evidence event. Found in the editor's source re-check of 19-20 october 2026: the researchers' timeline (curry) says '08/14/24 ... response from kia team indicating they had remediated the vulnerability and were performing testing'; wired (andy greenberg, 26 september 2024) reports that 'in august, kia told the researchers it had validated their findings but was still working on implementing a permanent fix', after an earlier change that 'appeared to block their technique, the researchers say'. both accounts are recorded and the field is marked disputed. kia's own words, as quoted by wired, are added under rule 16: the fix and the no-exploitation finding are otherwise reported by the researchers, not in a public kia statement.
  Show the change

  Before: {"value": "Researchers' write-up with demonstration; Kia told the researchers on 14 August 2024 that it had remediated the flaw, and the researchers confirmed the fix before publishing", "source_ids": ["CURRY"], "disputed": false}

  After: {"value": "Researchers' write-up with demonstration. The researchers' timeline records that on 14 August 2024 the Kia team said it had remediated the flaw and was performing testing, and that the researchers disclosed publicly on 26 September 2024 after validating the remediation. Wired's report of the same day gives a different account: shortly after the June report Kia made a change that, the researchers say, appeared to block their technique, and in August Kia told the researchers it had validated their findings but was still working on a permanent fix. Kia's public statement in the linked records is its June 2024 reply to Wired that it was investigating: 'We take this matter very seriously, and value our collaboration with security researchers.'", "source_ids": ["CURRY", "WIRED"], "disputed": true}
• 2026-10-20: Fields: outcome. Found in the editor's source re-check of 19-20 october 2026: neither linked record says the fix was deployed in august 2024. the researchers' timeline (curry) records only that on 14 august 2024 the kia team said it 'had remediated the vulnerability and were performing testing', and that they published on 26 september 2024 'after validating it had been remediated'; wired (26 september 2024) reports a change shortly after the june report and, in august, a permanent fix still in progress (see evidence).
  Show the change

  Before: State: averted by disclosure. No harm reported; fix deployed August 2024 before publication. As of Sep 2024

  After: State: averted by disclosure. No harm reported: the researchers write that the Kia team validated the flaw was never exploited maliciously, and that they disclosed it publicly on 26 September 2024 after validating that it had been remediated. As of Sep 2024
• 2026-10-20: Fields: envelope authority. Found in the editor's source re-check of 19-20 october 2026: the researchers' write-up (curry) says the token gave access to 'all dealer endpoints' and that the four requests worked on 'pretty much any kia vehicle made after 2013 (see "vehicles affected" table for specifics)'; 'any vehicle in the fleet' went further than the source.
  Show the change

  Before: A dealer token conferred authority over any vehicle in the fleet; no binding between the dealer and the vehicles it serviced

  After: A dealer token gave access to the dealer functions (owner lookup, owner demotion, adding an owner) for pretty much any Kia vehicle made after 2013, in the researchers' words; no binding between the dealer account and the vehicles it serviced
• 2026-10-20: Fields: actor status. Found in the editor's source re-check of 19-20 october 2026: the researchers' write-up (curry) shows the dealer token was used to demote the owner and then 'assign our attacker-controlled email as the primary owner of the vehicle. this will allow us to send arbitrary commands to the vehicle.' the commands reached the car as the owner's, not as a dealer's; the dealer misidentification was in the dealer system.
  Show the change

  Before: The vehicle's remote-command system, acting on commands from an actor it believed was a dealer

  After: The vehicle's remote-command system, acting on commands from the account recorded as the vehicle's primary owner; the researchers had made their own account that owner through the dealer system, which accepted their self-registered account as a dealer
• 2026-10-20: Context: actor type. Found in the editor's source re-check of 19-20 october 2026: the researchers' write-up (curry) says the attack worked on 'pretty much any kia vehicle made after 2013 (see "vehicles affected" table for specifics)'; its table runs from model year 2014 to 2025 and shows some trims with location only or no remote functions. '2013 onward' included a model year the source excludes.
  Show the change

  Before: Physical: Kia vehicles 2013 onward with connected services

  After: Physical: Kia vehicles made after 2013 with connected services (model years 2014 to 2025 in the researchers' table; the remote functions available vary by model and trim)
• 2026-10-16: Title and fields. Spelling standardized to american english for a us readership; no change of meaning.
  Show the change

  Before: British spelling (licence plate, licence plates)

  After: American spelling (license plate, license plates)
• 2026-10-14: Controls. Verifier rule 10: no linked source shows owner notification was absent; an unmentioned control is not recorded as absent.
  Show the change

  Before: absent candidate 'Owner notification on ownership reassignment'

  After: removed
• 2026-10-13: Fields and sources. Claims aligned to what each linked record says, found on review.
  Show the change

  Before: lookup 'by licence plate' in Kia's backend; 'manufacturer confirmed the fix'

  After: lookup by VIN, plate converted outside Kia's systems; who confirmed the fix, as the researchers record it
• 2026-10-13: Context: jurisdiction. Jurisdiction text was split at a comma inside parentheses.
  Show the change

  Before: United States (researcher | manufacturer)

  After: United States (researcher, manufacturer)