The vulnerability stems from an ineffective implementation of SSL certificate pinning in the network security configuration of the Tata Motors iRA 2.0 and iRA.ev mobile applications. Because the pinning controls are not properly enforced, the applications accept any peer certificate that matches the specified trust store, allowing an attacker to present a forged certificate and intercept network traffic. An attacker positioned to intercept this traffic could read or alter the data exchanged between the mobile app and backend services, potentially leaking confidential information or injecting malicious payloads. The impact therefore spans both confidentiality and integrity of all communications carried by these applications.

Affected products are Tata Motors iRA 2.0 (all releases up to version 26.7.3) and Tata Motors iRA.ev (up to version 26.7.2). All releases before the stated latest patches rely on the flawed SSL pinning configuration and are therefore vulnerable.

The CVSS base score of 8.5 indicates high severity, but the EPSS score is not available, leaving the exploitation probability uncertain. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a man‑in‑the‑middle intercept performed by an attacker with network access or control over the traffic between the mobile device and the backend services. Exploitation would require the attacker to deploy a rogue certificate that satisfies the application’s pinning logic, which is achievable with the described misconfiguration.