A team of cybersecurity researchers has successfully demonstrated a significant vulnerability in a 2020 Nissan Leaf. It enables them to remotely access and control numerous functions, including the car’s steering system, from anywhere in the world over the internet. The findings, detailed by digital security company PCAutomotive at the Black Hat Asia 2025 cybersecurity conference, highlight the potential risks with always-connected cars.
- Base Trim Engine
-
Electric
- Base Trim Transmission
-
Single Speed Automatic
- Base Trim Drivetrain
-
Front-Wheel Drive
The group gained access to the Nissan Leaf’s internal systems by exploiting a vulnerability within the Bluetooth function of its infotainment unit. The team was then able to escalate its privileges and gain further access via a cellular signal, allowing for remote commands over the internet.
In a video demonstrating their capabilities, PCAutomotive showcased a range of controls. Initially, they tracked the car’s location using its GPS. They then took over the vehicle’s infotainment screen, displaying a “Hacked by PCAutomotive” message. Terrifyingly, the researchers demonstrated the ability to remotely activate the Leaf’s in-car microphone, record audio from within the cabin, download the recording, and then play it back to the occupants through the car’s own speaker system.
Beyond Pranks: Taking Control of Critical Systems
While infotainment and audio system intrusions are concerning, the hack allowed for control over far more critical vehicle functions. PCAutomotive’s demonstration showed their ability to remotely honk the car’s horn, adjust side mirrors, roll the windows down, flash the headlights, turn on the windshield wipers, and lock or unlock the doors.
The most alarming capability, however, was remote control of the steering wheel. The researchers showed they could turn the steering wheel of the Nissan Leaf while it was both stationary and in motion. While the hack did not grant control over the vehicle’s throttle or braking systems, the ability to remotely take over steering raises significant safety concerns.
Related
The Cybersecurity Risks Threatening The Automotive Industry, And How To Combat Them
Cybersecurity is an increasing area of concern for the automotive industry. Here are some of the ways automakers are tackling new challenges.
Nissan’s Response And Lingering Questions
According to PCAutomotive, the initial disclosure of this vulnerability to Nissan occurred in 2023. Following PCAutomotive’s public presentation of its findings at Black Hat Asia, Nissan provided a statement to Road & Track.
PCAutomotive contacted Nissan regarding its research. While we decline to disclose specific countermeasures or details for security reasons, for the safety and peace of mind of our customers we will continue to develop and roll out technologies to combat increasingly sophisticated cyberattacks.
This statement, however, does not explicitly confirm whether the specific vulnerability demonstrated by PCAutomotive has been patched in affected Nissan Leaf vehicles. When asked for clarification, PCAutomotive said they had not received specific remediation details from the automaker.
Related
Millions Of Kias Could Be Hacked With Nothing But A License Plate Number
The hackers could control various functions and access cameras and personal information, but the issue has reportedly been resolved.
This lack of confirmation regarding a patch leaves Nissan Leaf owners, particularly those with models around the 2020 model year, in the dark. While automakers regularly issue software updates to address security concerns, without specific information from Nissan about this vulnerability, this specific vulnerability may still be a threat.
H/T: Road & Track
#Hackers #Figure #Remote #Control #Nissan #Leaf #Internet
