Kia dealer-portal flaw lets anyone register as a dealer and remotely control cars by license plate, disclosed September 2024
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | The vehicle owner, through Kia's owner portal; dealers, through a dealer portal | assertion downgraded by verifier | Sam Curry, Neiko Rivera, Justin Rhinehart, Ian Carroll, Kenneth Lugo, 'Hacking Kia: Remotely Controlling Cars With Just a License Plate' | high |
| Actor: status | The vehicle's remote-command system, acting on commands from the account recorded as the vehicle's primary owner; the researchers had made their own account that owner through the dealer system, which accepted their self-registered account as a dealer | assertion downgraded by verifier | Sam Curry, Neiko Rivera, Justin Rhinehart, Ian Carroll, Kenneth Lugo, 'Hacking Kia: Remotely Controlling Cars With Just a License Plate' | high |
| Inputs | A dealer account the researchers registered themselves; the dealer portal did not verify dealer status | assertion | Sam Curry, Neiko Rivera, Justin Rhinehart, Ian Carroll, Kenneth Lugo, 'Hacking Kia: Remotely Controlling Cars With Just a License Plate' | high |
| Decision | The backend accepted the dealer token and allowed vehicle lookup by VIN (the researchers converted license plates to VINs with a third-party service), then reassignment of the vehicle to a new owner account | assertion | Sam Curry, Neiko Rivera, Justin Rhinehart, Ian Carroll, Kenneth Lugo, 'Hacking Kia: Remotely Controlling Cars With Just a License Plate' | high |
| Envelope: authority | A dealer token gave access to the dealer functions (owner lookup, owner demotion, adding an owner) for pretty much any Kia vehicle made after 2013, in the researchers' words; no binding between the dealer account and the vehicles it serviced | assertion | Sam Curry, Neiko Rivera, Justin Rhinehart, Ian Carroll, Kenneth Lugo, 'Hacking Kia: Remotely Controlling Cars With Just a License Plate' | high |
| Action | Remote lock and unlock, start and stop, horn, and location, on vehicles the researchers did not own | assertion | Sam Curry, Neiko Rivera, Justin Rhinehart, Ian Carroll, Kenneth Lugo, 'Hacking Kia: Remotely Controlling Cars With Just a License Plate' | high |
| Outcome | State: averted by disclosure. No harm reported: the researchers write that the Kia team validated the flaw was never exploited maliciously, and that they disclosed it publicly on 26 September 2024 after validating that it had been remediated. As of Sep 2024. | assertion downgraded by verifier | Sam Curry, Neiko Rivera, Justin Rhinehart, Ian Carroll, Kenneth Lugo, 'Hacking Kia: Remotely Controlling Cars With Just a License Plate' | high |
| Evidence: event | Researchers' write-up with demonstration. The researchers' timeline records that on 14 August 2024 the Kia team said it had remediated the flaw and was performing testing, and that the researchers disclosed publicly on 26 September 2024 after validating the remediation. Wired's report of the same day gives a different account: shortly after the June report Kia made a change that, the researchers say, appeared to block their technique, and in August Kia told the researchers it had validated their findings but was still working on a permanent fix. Kia's public statement in the linked records is its June 2024 reply to Wired that it was investigating: 'We take this matter very seriously, and value our collaboration with security researchers.' | assertion | Sam Curry, Neiko Rivera, Justin Rhinehart, Ian Carroll, Kenneth Lugo, 'Hacking Kia: Remotely Controlling Cars With Just a License Plate'; Millions of Vehicles Could Be Hacked and Tracked Thanks to a Simple Website Bug (WIRED, Andy Greenberg) | high |
| Recovery: technical | Backend fix by the manufacturer | assertion downgraded by verifier | Sam Curry, Neiko Rivera, Justin Rhinehart, Ian Carroll, Kenneth Lugo, 'Hacking Kia: Remotely Controlling Cars With Just a License Plate' | high |
| Recovery: accountability | None; coordinated disclosure | assertion downgraded by verifier | Sam Curry, Neiko Rivera, Justin Rhinehart, Ian Carroll, Kenneth Lugo, 'Hacking Kia: Remotely Controlling Cars With Just a License Plate' | high |
Controls
| Status | Control | Canonical |
|---|---|---|
| failed | Dealer identity verification | C-A1 Actor identity verification |
| failed | Dealer-to-vehicle authority binding | C-A2 Authority binding |
| succeeded | Coordinated disclosure and pre-publication fix | C-O1 Coordinated disclosure program |
| absent | Owner notification on access changes: the researchers write that, from the victim's side, there was no notification that the vehicle had been accessed or its access permissions modified | C-I4 Warnings designed as alerts |
Inference
inference The vehicle did nothing wrong: it obeyed a valid command. The failure was in the backend, in who could get a dealer credential and how much authority that credential carried. That is why a case where the car decided nothing belongs in a register of autonomous action. The record does not say what was changed in the backend to fix it, and the accounts of when it was fixed differ.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| CURRY | Sam Curry, Neiko Rivera, Justin Rhinehart, Ian Carroll, Kenneth Lugo, 'Hacking Kia: Remotely Controlling Cars With Just a License Plate' | researcher primary record | samcurry.net ↗ checked 2026-10-20 |
| WIRED | Millions of Vehicles Could Be Hacked and Tracked Thanks to a Simple Website Bug (WIRED, Andy Greenberg) | press pointer secondary: press report | wired.com ↗ checked 2026-10-20 |