Carmakers can patch a map update from a desk, but a flaw in the box deciding when the brakes bite still typically means driving the car in, the eSync Alliance said this week.
The association argues that most manufacturer over-the-air systems were designed around the infotainment screen and the telematics unit. Braking, steering and driver assistance controllers mostly arrive from separate specialist suppliers, each with its own software route, and are often refreshed only during a service – or never.
Why a recall is the default
Mike Gardner, executive director of the Alliance, told the trade press the flaw in a brake or steering controller is exactly what an attacker hunts for and today the least fixable part of the car. If a recall is the only channel, exposure lasts as long as it takes owners to book a slot.
Dealers inherit the problem: every delayed appointment becomes an aftersales burden and, eventually, a recall.
The warning that it can be done better
The group points to the PerfektBlue Bluetooth bugs, disclosed by PCA Cyber Security in OpenSynergy’s BlueSDK and demonstrated against infotainment units in Volkswagen, Mercedes-Benz and Skoda models. OpenSynergy shipped patches to its customers in September 2024, yet PCA reported that not every affected carmaker had the fix through its supply chain by June 2025.
Gardner says a common update standard would let one secure channel reach every controller at once, and that it already runs at production scale on selected models. The QNX survey cited alongside it, of 1,100 embedded automotive developers, found 83% expect software-defined vehicles to become a major cyberattack target inside three years.
None of this is a disclosed vulnerability, and no attacker is named. The claim is narrower and, for buyers, harder to shrug off: defender reach ends where the supplier list begins.
