Subaru Starlink Vulnerability Exposed Cars to Remote Hacking

Summary: Security researchers Sam Curry and Shubham Shah found flaws in Subaru’s employee-facing STARLINK administration portal that could have enabled an attacker to access customer data, retrieve vehicle locations and issue remote commands to connected cars.

What the researchers found

The investigation identified a password-reset endpoint that did not require the expected confirmation token. After taking over an employee account, the researchers found that the portal’s second-factor prompt could be bypassed because it was enforced in the browser interface rather than consistently on the server.

With administrative access, a malicious user could have searched for vehicles using customer information and viewed personally identifiable information, support history and detailed location records. The portal also exposed controls for actions such as locking, unlocking and starting a vehicle.

Scope and remediation

The researchers said the issue affected connected Subaru vehicles and customer accounts in the United States, Canada and Japan. They reported the problem to Subaru, which patched the affected system within 24 hours. The researchers also said they found no evidence that the vulnerability had been maliciously exploited.

Why it matters

Connected-vehicle security depends on much more than the mobile app inside a driver’s phone. Employee portals, password-reset systems and administrative APIs can carry broader privileges and therefore require strong server-side authorization, short sessions and detailed monitoring.

Practical takeaway

• Enforce authentication and authorization on every server-side action, not only in the user interface.
• Protect password-reset flows with expiring, single-use tokens and rate limiting.
• Limit staff access to customer location and remote vehicle controls according to job role.

Original sources: Sam Curry — Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel; SecurityWeek — Subaru Starlink Vulnerability Exposed Cars to Remote Hacking

Independently summarized and reviewed by CNB Telecom. Last reviewed: September 4, 2026.