EV chargers and IVI systems: what Pwn2Own Automotive exposed

TL;DR: Pwn2Own Automotive 2026 surfaced 76 unique zero-day vulnerabilities across EV chargers, Tesla interfaces and IVI systems, showing that NFC taps, hardcoded credentials and USB inputs can all become practical attack paths when validation and isolation are weak, according to VicOne. The result is a reminder that connected vehicle risk now sits in interfaces and trust boundaries as much as in core vehicle software.

Editorial analysis by NHI Mgmt Group, based on content published by VicOne: “Attack Surfaces from Pwn2Own Automotive 2026: Key Findings for Security Teams”.

By the numbers:

• Pwn2Own Automotive 2026 produced 76 unique zero-day vulnerabilities across automotive technologies.

Key questions

Q: What breaks when a connected vehicle interface is trusted too broadly?

A: When a contactless or physical interface is trusted too broadly, untrusted input can reach parsing logic, maintenance functions or operational controls.

Q: Why do hardcoded credentials increase risk in EV charging and infotainment systems?

A: Hardcoded credentials create the same access pattern across many devices, which means one leak or one reverse-engineered secret can expose repeated functions across a fleet.

Q: How do teams know whether embedded interface controls are actually working?

A: Teams should look for whether untrusted input is being rejected, whether privileged functions require unique credentials, and whether firmware or configuration content is blocked when integrity checks fail.

Practitioner guidance

• Harden NFC input paths Apply the same validation standards to contactless input that you require for network-facing interfaces, and test embedded parsers for overflow and malformed input handling.
• Eliminate shared maintenance credentials Replace hardcoded, default or reused secrets with unique, revocable credentials for provisioning and service operations across the charger fleet.
• Require integrity checks for all executable content Reject firmware, scripts and configuration packages unless the device can cryptographically verify their origin and integrity before execution.

Bottom line: Connected vehicle risk now extends to interfaces that were originally designed for convenience, including NFC taps, USB media and maintenance paths.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →