Dealerships could face a growing aftersales and recall burden because many safety-critical vehicle controllers cannot receive remote security updates, the eSync Alliance has warned.
The automotive technology association said vulnerabilities affecting braking, steering or driver assistance controllers may remain unresolved until an owner takes the vehicle into a workshop.
This could leave affected cars exposed for months if customers delay booking an appointment, while vehicles that never return to an authorised workshop may remain unpatched.
Critical fixes still need workshops
Many manufacturer over-the-air update systems were originally designed around infotainment and telematics systems, according to the alliance.
However, the controllers that handle braking, steering and driver assistance usually come from separate specialist suppliers, each with its own way of receiving software. Many are updated only at a service, or not at all.
As connected and software-defined vehicles become more widespread, experts believe they could pose a major target for cyberattacks within the next three years, according to a QNX survey of 1,100 embedded automotive software developers.
Mike Gardner, executive director of the eSync Alliance, said: “A security flaw in a brake or steering controller is exactly what an attacker would look for, and today it is often the hardest thing to fix. If the only way to patch it is a recall, every car stays exposed until its owner books it in, and some never will.”
Supply chain slowed security patch
The complexity of distributing security updates was demonstrated by the PerfektBlue vulnerabilities identified in OpenSynergy’s BlueSDK Bluetooth software.
Researchers at PCA Cyber Security demonstrated the vulnerabilities on infotainment systems used by Volkswagen, Mercedes-Benz and Skoda. The tests showed that an attacker could gain access to affected infotainment systems, although they did not demonstrate the compromise of braking or steering controls.
OpenSynergy made patches available to its customers in September 2024, but PCA said not every affected manufacturer had received the patch through its supply chain by June 2025.
Gardner said: “It does not have to be that way. A common update standard across suppliers lets a carmaker reach every controller in the vehicle through one secure channel and fix them together.
“That approach is already running at production scale on selected models in production in nations all over the world, and it needs to become the norm before the attacks arrive, not after.”
The eSync Alliance is promoting a common over-the-air data pipeline that would allow manufacturers and suppliers to distribute software updates and receive diagnostic information through a standardised system.
Ensure you always receive AM insights. Make us a preferred source of news on Google