Researchers from Sweden’s University of Gothenburg analyzed the United States National Vulnerability Database and identified 413 known vulnerabilities affecting internet-connected cars. The data covered the period from January 2022 to September 2023.
The authors said attackers exploiting such vulnerabilities could compromise vehicle-control functions, including the brakes or steering. The findings were published in the journal Software Quality Journal.
“Modern cars contain several interconnected computer systems. Some handle entertainment and communications, while others control critical functions such as braking, steering and acceleration,” explained the study’s lead author, Dr. Srijita Basu. She added that if an attacker penetrated one system and could move into another because of weak security boundaries, the consequences could be serious.

The researchers themselves did not demonstrate taking control of the brakes through any of the 413 vulnerabilities. Basu stressed that detecting a vulnerability does not necessarily mean it can be exploited remotely. The largest share of weaknesses, 36.2 percent, was found in external applications, including web services, cloud platforms and mobile applications connected to the vehicles.
In 2015, researchers used the Jeep Cherokee’s multimedia system to take control of the vehicle’s steering and brakes, after which the manufacturer recalled 1.4 million vehicles.