Researchers from PCAutomotive have uncovered a series of serious vulnerabilities
in the 2020 Nissan Leaf electric vehicle, which can be exploited remotely to spy on the driver and even take physical control of the car. Their findings were presented at Black Hat Asia 2025, shedding light on potential risks associated with modern vehicle connectivity.
The vulnerabilities affect the second-generation Nissan Leaf and stem from flaws in the car’s infotainment system, specifically its Bluetooth capabilities. By exploiting these weaknesses, the researchers were able to breach the vehicle’s internal network. Once inside, they escalated their privileges and established a command-and-control (C&C) channel via the vehicle’s cellular connection. This allowed for persistent and stealthy access to the vehicle over the internet.
Using this access, the team demonstrated how a hacker could track the car’s location, capture screenshots of the infotainment system, and record in-cabin conversations, effectively turning the car into a mobile surveillance tool.
More alarmingly, they were also able to remotely control several of the car’s physical functions, such as the doors, wipers, horn, mirrors, windows, and lights. They even managed to take control of the steering wheel, including while the car was in motion, raising significant safety concerns.
The vulnerabilities have been officially documented with eight CVE identifiers ranging from CVE-2025-32056 to CVE-2025-32063. PCAutomotive began the responsible disclosure process in August 2023, and Nissan confirmed the issues by January 2024, although it took until recently for the CVEs to be assigned.
A Nissan spokesperson acknowledged PCAutomotive’s findings and stated that while specific countermeasures will not be publicly disclosed for security reasons, the company is committed to rolling out technologies to protect customers from increasingly sophisticated cyber threats.
Found this article interesting? Follow us on X(Twitter) and FaceBook to read more exclusive content we post.
