The vulnerabilities being disclosed here only impact commercial vehicles and customers in India.

A lucky breakthrough

The vulnerability was incredibly simple and discovered through sheer luck. Here is an API that is used on the homepage of the website to check your mobile #: https://www.myeicher.in/cepauthmgr/user/validateMobileNo

The Javascript on the website has many other APIs like that. There were some other interesting ones, but nothing that could be used to hack the entire platform. Then, just randomly one day, I decided to try going to this endpoint on my browser: https://www.myeicher.in/cepauthmgr/user/

In 99% of cases, walking up the API path results in an HTTP error. This time, it revealed a big list of all the user-related APIs:

You can view the full list here.

Even better, they were unauthenticated! I found a “customers” endpoint and it revealed a massive list of 748k customers:

There were also “users” and “persons”:

It even returned the password to you. It was encrypted though, so it couldn’t be used. This was still a massive breakthrough – it was no longer difficult to find people who use this system. These APIs gave me the entire list of accounts. If there was some sort of login exploit, it would be game over for everyone in here.

All your OTPs are mine

My luck continued to grow: there was an API that returned the entire list of 2.5 million OTPs going back to 2021:

There were also more specific APIs to return OTPs for specific mobile #s:

You can probably guess where this is going. The stage has been set for an account takeover!

Step 1: Pick a mobile # from the user list and send the OTP. I picked one linked to a large engineering company.

Step 2: Use the API to find the OTP by mobile #:

Step 3: Plug it in. This technique gave me full control over any user account, and by extension, the vehicles/fleets.

The side effect of all this is that you tip off the person by actually sending them the OTP, so it’s unfortunately not a silent account takeover. However, there was a second account takeover method! There are APIs to update the password on the account, so you could set one and then log in using password. The user presumably would not be notified, but I am not 100% sure.

Exploring

Here’s some additional screenshots documenting what kind of things I had access to.

This is the response from the vehicles API. There were 676k!

This is a map that lets you track all your vehicles:

Here are the individual tracking details of specific vehicles:

The live vehicle cluster, which supposedly is representative of what the driver sees:

Here are many other features:

Sensitive Data

It gets worse! There were a few APIs relating to documents that revealed 76k documents and images people have uploaded. This includes very sensitive ID documents like Aadhaar cards and driving licenses.

Timeline

I found someone who had reported a vulnerability to VECV in the past and they gave me their infosec email address.

• November 3, 2025: Reported.
• November 10, 2025: No response, followed up.
• November 17, 2025: No response, followed up and copied some additional people on the thread.
• November 20, 2025: It was no longer possible to access any of the internal APIs. The primary vulnerability was now fixed.
• July 27, 2026: Published

After November 2025, I had some additional concerns that I attempted to relay to them, including over the general customer support line, but was unsuccessful in getting in contact with anyone there who cared enough to investigate them. After a few months of waiting, I gave up on these other concerns. At least they fixed the primary vulnerability.