The software running inside modern cars carries a hefty backlog of known security flaws, according to new research from Telecom SudParis. The team built a vulnerability scanner called VERA and tested it against the operating systems powering today’s vehicles, including automotive grade Linux, Android Automotive, QNX, and VxWorks. Standard tools like Trivy produced more than 1,000 false positives on a single image, but VERA filters out findings that only apply to development environments.
Automotive Grade Linux topped the chart with 1,203 documented vulnerabilities in the tested version. Android Automotive posted a similar count. Even safety-certified systems like QNX Neutrino showed 56 known flaws, while VxWorks 7 logged low double digits. Eclipse S-CORE, a leaner stack, came in at just eight.
A high number of documented flaws does not mean a high number of exploitable attack vectors, the researchers caution. Many vulnerabilities live in code that a locked-down vehicle would never expose. The team demonstrated two working attacks to illustrate the gap. One exploited a SQLite bug in Android Automotive. The other targeted the SOME/IP service discovery protocol on Red Hat’s AutoSD and Tesla’s software, successfully knocking a service offline. The same attack failed on Android Automotive because the platform shuffles its port numbers.
The arXiv paper includes the exploit code and a direct argument. Every known vulnerability in these operating systems is technically relevant because modern cars use the same code bases as standard computers. The practical job for security teams is filtering that noise down to what an attacker could realistically reach.
