The vulnerability within the iRA 2.0 and iRA.ev mobile applications allows an attacker to retrieve hard‑coded service account credentials, API keys, and authorization tokens that are embedded in the application package. An unauthenticated remote attacker can download the package, unpack it, and expose these secrets, which then enable the attacker to authenticate to backend services and potentially read or modify data and perform unauthorized operations. The weakness corresponds to CWE‑798, compromising both confidentiality and integrity of the system.

Tata Motors iRA 2.0 (vulnerable versions 26.7.3 and below) and Tata Motors iRA.ev (vulnerable versions 26.7.2 and below).

With a CVSS score of 8.8 the vulnerability is considered high severity. While no EPSS score is available, the presence of hard‑coded credentials means that once the application package is publicly distributed, the attack surface is readily exploitable. The attack vector is remote and does not require authentication to the mobile device; an attacker can simply download the app and extract secrets. The vulnerability is not listed in the CISA KEV catalog, but its impact on backend services warrants urgent mitigation.