{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T19:19:55Z","timestamp":1792783195927,"version":"4.5.0"},"reference-count":53,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,9,12]],"date-time":"2026-09-12T00:00:00Z","timestamp":1789171200000},"content-version":"vor","delay-in-days":11,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"University of Gothenburg","id":[{"id":"https:\/\/ror.org\/01tm6cn81","id-type":"ROR","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Software Qual J"],"published-print":{"date-parts":[[2026,9]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>The increased level of connectivity for vehicles leads to sophisticated and challenging software security concerns for automotive Original Equipment Manufacturers (OEMs) and suppliers. With a Connected Vehicle (CV) communicating with multiple entities (road infrastructure, other vehicles, OEMs, cloud, etc.), new attack surfaces are exposed to intruders. For instance, in 2023, ethical hackers demonstrated remote access to critical vehicle controls like steering and braking through vulnerabilities in infotainment and telematics systems. Several OEMs also reported production disruptions due to ransomware targeting software development infrastructure. Additionally, the current state of the art fails to provide a holistic view of a secure software development process for CVs. This paper presents a survey of automotive software vulnerabilities and associated attack vectors and analyzes the significant changes in security trends. Moreover, the vulnerabilities are tracked across the Software Development Life Cycle (SDLC). We include 413 new automotive software vulnerabilities identified within the last 2 years and 9 months in our study. Additionally, 20 automotive software repositories with 827 vulnerable libraries are identified by scanning sources such as repositories, SBOMs (Software Bill of Materials), images, and manifest files. We provide several security recommendations for software engineering teams based on the findings. Our findings are a step forward to support the maintenance of automotive software quality in terms of security across its entire life cycle.<\/jats:p>","DOI":"10.1007\/s11219-026-09787-y","type":"journal-article","created":{"date-parts":[[2026,9,12]],"date-time":"2026-09-12T02:17:50Z","timestamp":1789179470000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Mapping the landscape of software vulnerabilities in connected vehicles"],"prefix":"10.1007","volume":"34","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6835-947X","authenticated-orcid":false,"given":"Srijita","family":"Basu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9052-0864","authenticated-orcid":false,"given":"Miroslaw","family":"Staron","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3383-9617","authenticated-orcid":false,"given":"Magnus","family":"Almgren","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2019-5277","authenticated-orcid":false,"given":"Jennifer","family":"Horkoff","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3929-0925","authenticated-orcid":false,"given":"Christian","family":"Berger","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,9,12]]},"reference":[{"issue":"22","key":"9787_CR1","doi-asserted-by":"publisher","first-page":"7712","DOI":"10.3390\/s21227712","volume":"21","author":"G Abdelkader","year":"2021","unstructured":"Abdelkader, G., Elgazzar, K., & Khamis, A. (2021). Connected vehicles: Technology review, state of the art, challenges and opportunities. Sensors, 21(22), 7712.","journal-title":"Sensors"},{"key":"9787_CR2","unstructured":"Assal, H., & Chiasson, S. (2018). Security in the software development lifecycle. In 14th symposium on usable privacy and security (SOUPS 2018), (pp. 281\u2013296)."},{"key":"9787_CR3","doi-asserted-by":"crossref","unstructured":"Bagnara, R., Bagnara, A., & Hill, P. M. (2018). The MISRA C coding standard and its role in the development and analysis of safety-and security-critical embedded software. In International Static Analysis Symposium, (pp. 5\u201323). Cham: Springer International Publishing.","DOI":"10.1007\/978-3-319-99725-4_2"},{"key":"9787_CR4","unstructured":"Basu, S., Haraldsson, B., Staron, M., Berger, C., Horkoff, J., & Almgren, M. (2025). An AUTOSAR-aligned architectural study of vulnerabilities in automotive SoC software. arXiv preprint arXiv:2510.07941"},{"key":"9787_CR5","unstructured":"Berard, D., & Dehors, V. (2023). Security of connected vehicles."},{"key":"9787_CR6","doi-asserted-by":"crossref","unstructured":"Costantino, G., De Vincenzi, M., & Matteucci, I. (2022). A comparative analysis of unece wp. 29 r155 and ISO\/SAE 21434. In 2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), (pp. 340\u2013347). IEEE.","DOI":"10.1109\/EuroSPW55150.2022.00041"},{"key":"9787_CR7","doi-asserted-by":"crossref","unstructured":"Costantino, G., De Vincenzi, M., & Matteucci, I. (2022). A comparative analysis of unece wp. 29 r155 and ISO\/SAE 21434. In 2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), (pp. 340\u2013347). IEEE.","DOI":"10.1109\/EuroSPW55150.2022.00041"},{"key":"9787_CR8","unstructured":"CVE-2023-28901 (n.d.). Trip Data Disclosure from Backend. https:\/\/asrg.io\/security-advisories\/cve-2023-28901-trip-data-disclosure-from-backend\/"},{"key":"9787_CR9","unstructured":"CVE-2023-3121 (n.d.). Detail. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-3121. Last Accessed 16 May 2024."},{"key":"9787_CR10","unstructured":"CWE-798 (n.d.). Use of Hard-coded Credentials. https:\/\/cwe.mitre.org\/data\/definitions\/798.html. Last Accessed 16 July 2024."},{"key":"9787_CR11","unstructured":"CWE-918 (n.d.). Server-Side Request Forgery (SSRF). https:\/\/cwe.mitre.org\/data\/definitions\/918.html. Last Accessed 16 July 2024."},{"key":"9787_CR12","unstructured":"Darkreading (n.d.). Volkswagen Breach Exposes Data of 800K EV Customers. https:\/\/www.darkreading.com\/cyberattacks-data-breaches\/volkswagen-breach-exposes-data-of-800k-customers"},{"key":"9787_CR13","unstructured":"Docker Inc. (n.d.). Docker Scout Documentation. https:\/\/docs.docker.com\/scout\/. Last Accesses 25\/08\/09."},{"key":"9787_CR14","unstructured":"Dreyer, J. T. (2023). From talking past each other to barely talking. Comparative Connections: A Triannual E-Journal on East Asian Bilateral Relations, (2), 25."},{"key":"9787_CR15","doi-asserted-by":"crossref","unstructured":"Garcia, J., Feng, Y., Shen, J., Almanee, S., Xia, Y., & Chen, A. Q. A. (2020). A comprehensive study of autonomous vehicle bugs. In Proceedings of the ACM\/IEEE 42nd international conference on software engineering, (pp. 385\u2013396).","DOI":"10.1145\/3377811.3380397"},{"key":"9787_CR16","unstructured":"Global Automotive Cyber Security Report (2024) Upstream"},{"key":"9787_CR17","unstructured":"Grype (n.d.). https:\/\/www.cisa.gov\/resources-tools\/services\/grype. Last Accessed 24\/10\/29."},{"key":"9787_CR18","unstructured":"G\u00fclsever, M. (2019). A Study on Vulnerabilities in Connected Cars."},{"key":"9787_CR19","unstructured":"Hedgren, K. D. (2024). Designing Secure Applications for the Internet of Vehicles. Master\u2019s Thesis, Chalmers University of Technology University OF Gothenbur."},{"key":"9787_CR20","unstructured":"Howard, M. (n.d.). Address Space Layout Randomization in Windows Vista. https:\/\/learn.microsoft.com\/en-us\/archive\/blogs\/michael_howard\/address-space-layout-randomization-in-windows-vista. Last Accessed: 2023\/04\/07."},{"key":"9787_CR21","unstructured":"https:\/\/attack.mitre.org\/. Last Accessed 2024\/11\/13."},{"key":"9787_CR22","unstructured":"https:\/\/cwe.mitre.org\/data\/definitions\/120.html#REF-56_120. Last Accessed 2024\/10\/21."},{"key":"9787_CR23","unstructured":"https:\/\/cwe.mitre.org\/data\/definitions\/617.html. Last Accessed 2024\/10\/08."},{"key":"9787_CR24","unstructured":"https:\/\/cwe.mitre.org\/data\/definitions\/829.html. Last Accessed 2024\/10\/08."},{"key":"9787_CR25","unstructured":"https:\/\/mas.owasp.org\/MASTG\/tests\/android\/MASVS-CODE\/MASTG-TEST-0043\/#static-analysis. Last Accessed 2024\/06\/24."},{"key":"9787_CR26","unstructured":"https:\/\/owasp.org\/www-project-enterprise-security-api\/. Last Accessed 2024\/06\/24."},{"key":"9787_CR27","unstructured":"https:\/\/owasp.org\/www-project-secure-coding-practices-quick-reference-guide\/. Last Accessed 2024\/10\/10."},{"key":"9787_CR28","unstructured":"https:\/\/portswigger.net\/daily-swig\/automotive . Last Accessed 2024\/10\/26."},{"issue":"1","key":"9787_CR29","doi-asserted-by":"publisher","first-page":"21","DOI":"10.1365\/s43439-023-00102-0","volume":"5","author":"M Iwasaki","year":"2024","unstructured":"Iwasaki, M. (2024). Fortifying the weakest link: cybersecurity coordination in supply chains and competition rules. International Cybersecurity Law Review, 5(1), 21\u201329.","journal-title":"International Cybersecurity Law Review"},{"issue":"3","key":"9787_CR30","doi-asserted-by":"publisher","first-page":"1534","DOI":"10.1109\/COMST.2022.3187531","volume":"24","author":"S Kim","year":"2022","unstructured":"Kim, S., Park, K. J., & Lu, C. (2022). A survey on network security for cyber-physical systems: From threats to resilient design. IEEE Communications Surveys & Tutorials, 24(3), 1534\u20131573.","journal-title":"IEEE Communications Surveys & Tutorials"},{"key":"9787_CR31","doi-asserted-by":"crossref","unstructured":"Kochanthara, S., Dajsuren, Y., Cleophas, L., & van den Brand, M. (2022). Painting the landscape of automotive software in GitHub. In Proceedings of the 19th International Conference on Mining Software Repositories, (pp. 215-226).","DOI":"10.1145\/3524842.3528460"},{"key":"9787_CR32","unstructured":"Leyden, J. (2019). Tesla security bug uncovered after minor accident. The Daily Swig. https:\/\/portswigger.net\/daily-swig\/tesla-security-bug-uncovered-after-minor-accident"},{"key":"9787_CR33","unstructured":"Microsoft (n.d.). Using the Strsafe.h Functions. https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/menurc\/strsafe-ovw?redirectedfrom=MSDN. Last Accessed 2023\/04\/07."},{"key":"9787_CR34","unstructured":"Miller, C., & Valasek, C. (2015). Remote exploitation of an unaltered passenger vehicle (pp. 1\u201391). Black Hat USA, (S 91), (pp. 1\u201391)."},{"key":"9787_CR35","doi-asserted-by":"publisher","first-page":"120102","DOI":"10.1016\/j.techfore.2020.120102","volume":"157","author":"D Morris","year":"2020","unstructured":"Morris, D., Madzudzo, G., & Garcia-Perez, A. (2020). Cybersecurity threats in the auto industry: Tensions in the knowledge environment. Technological Forecasting and Social Change, 157, 120102.","journal-title":"Technological Forecasting and Social Change"},{"key":"9787_CR36","doi-asserted-by":"crossref","unstructured":"Moukahal, L. J., Zulkernine, M., & Soukup, M. (2021). Towards a secure software lifecycle for autonomous vehicles. In 2021 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW), (pp. 371\u2013377). IEEE.","DOI":"10.1109\/ISSREW53611.2021.00104"},{"key":"9787_CR37","unstructured":"Murphy, G. (n.d.). Position Independent Executables (PIE). Red Hat. 2012-11-28. https:\/\/www.redhat.com\/en\/blog\/position-independent-executables-pie. Last Accessed: 2023\/04\/07."},{"issue":"1","key":"9787_CR38","first-page":"16","volume":"25","author":"S Nie","year":"2017","unstructured":"Nie, S., Liu, L., & Du, Y. (2017). Free-fall: Hacking tesla from wireless to can bus. Briefing, Black Hat USA, 25(1), 16.","journal-title":"Briefing, Black Hat USA"},{"key":"9787_CR39","doi-asserted-by":"publisher","first-page":"102269","DOI":"10.1016\/j.cose.2021.102269","volume":"109","author":"M Pham","year":"2021","unstructured":"Pham, M., & Xiong, K. (2021). A survey on security attacks and defense techniques for connected and autonomous vehicles. Computers & Security, 109, 102269.","journal-title":"Computers & Security"},{"key":"9787_CR40","unstructured":"Qualcomm Technologies, Inc. (2024). Qualcomm product security bulletins. Qualcomm Technologies, Inc. https:\/\/www.qualcomm.com\/company\/product-security\/bulletins"},{"key":"9787_CR41","unstructured":"Red Hat (n.d.). Audit system architecture (in Chapter 7. System auditing). In Security Guide, Red Hat Enterprise Linux 7. https:\/\/docs.redhat.com\/en\/documentation\/red_hat_enterprise_linux\/7\/html\/security_guide\/chap-system_auditing#sec-audit_system_architecture"},{"key":"9787_CR42","doi-asserted-by":"crossref","unstructured":"Ryan, M. K., & Rozier, K. Y. (2024). A survey and analysis of recent IoT device vulnerabilities.","DOI":"10.21203\/rs.3.rs-3982790\/v1"},{"key":"9787_CR43","unstructured":"SAFe 6.0 (2023). https:\/\/scaledagileframework.com\/ released in March 2023."},{"key":"9787_CR44","unstructured":"Snyk (2023). Snyk named a leader in The Forrester Wave: SCA, Q2 2023. https:\/\/snyk.io\/blog\/snyk-named-leader-in-strategy-category-forrester-wave-sca-q2-2023\/. Last Accesses 25\/08\/09."},{"key":"9787_CR45","unstructured":"Standard, C. C. (2016). SEI CERT."},{"key":"9787_CR46","doi-asserted-by":"crossref","unstructured":"Staron, M. (2020). Action research in software engineering (p. 50). Berlin\/Heidelberg, Germany: Springer International Publishing.","DOI":"10.1007\/978-3-030-32610-4"},{"issue":"7","key":"9787_CR47","doi-asserted-by":"publisher","first-page":"6240","DOI":"10.1109\/TITS.2021.3085297","volume":"23","author":"X Sun","year":"2021","unstructured":"Sun, X., Yu, F. R., & Zhang, P. (2021). A survey on cyber-security of connected and autonomous vehicles (CAVs). IEEE Transactions on Intelligent Transportation Systems, 23(7), 6240\u20136259.","journal-title":"IEEE Transactions on Intelligent Transportation Systems"},{"key":"9787_CR48","unstructured":"Threat Actors, Car Systems, and Weak API Security. http:\/\/avertium.com\/resources\/threat-reports\/tir-20230213-threat-actors-car-systems-and-weak-api-security"},{"key":"9787_CR49","unstructured":"Vulert\u2019s (n.d.). All-in-One Open Source Security and Compliance Platform. https:\/\/vulert.com\/. Last Accesses 25\/08\/09."},{"key":"9787_CR50","unstructured":"Wichers, D. (n.d.). Free for Open Source Application Security Tools. https:\/\/owasp.org\/www-community\/Free_for_Open_Source_Application_Security_Tools. Last Accessed 24\/06\/22."},{"key":"9787_CR51","unstructured":"Williams, J. (2020). How to build awesome security instrumentation to automate AppSec testing and protection [Conference presentation]. OWASP. https:\/\/share.google\/NqDwzorvIK9CJ9fmM"},{"key":"9787_CR52","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-29044-2","volume-title":"Experimentation in software engineering","author":"C Wohlin","year":"2012","unstructured":"Wohlin, C., Runeson, P., H\u00f6st, M., Ohlsson, M. C., Regnell, B., & Wessl\u00e9n, A. (2012). Experimentation in software engineering (Vol. 236). Berlin: Springer."},{"key":"9787_CR53","doi-asserted-by":"crossref","unstructured":"Xiong, W., G\u00fclsever, M., Kaya, K.M., & Lagerstr\u00f6m, R. (2019). A Study of Security Vulnerabilities and Software Weaknesses in Vehicles. In A. Askarov, R. Hansen, & W. Rafnsson (Eds.) Secure IT Systems. NordSec 2019. Lecture Notes in Computer Science, vol 11875. Springer, Cham.","DOI":"10.1007\/978-3-030-35055-0_13"}],"container-title":["Software Quality Journal"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11219-026-09787-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11219-026-09787-y","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11219-026-09787-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T11:00:33Z","timestamp":1790852433000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11219-026-09787-y"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9]]},"references-count":53,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2026,9]]}},"alternative-id":["9787"],"URL":"https:\/\/doi.org\/10.1007\/s11219-026-09787-y","relation":{},"ISSN":["0963-9314","1573-1367"],"issn-type":[{"value":"0963-9314","type":"print"},{"value":"1573-1367","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9]]},"assertion":[{"value":"2 December 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"29 August 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"12 September 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"The authors declare no competing interests.","order":1,"name":"Ethics","label":"Competing interests","group":{"name":"EthicsHeading","label":"Declarations"}}],"article-number":"52"}}