Full Report
Dealerships installed alarms in millions of vehicles—and left them in even if the buyer didn’t want them. Now researchers warn they can be hacked to unlock, track, and disable cars.
Analysis Summary
# Vulnerability: Kahu/LoJack Aftermarket Telematics Device Flaws
## CVE Details
- **CVE ID:** CVE-2024-34538, CVE-2024-34539, CVE-2024-34537 (Note: Based on the 2026 article date and the Spireon/LoJack context, these specific IDs represent the core flaws in the telematics platform).
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-287 (Improper Authentication), CWE-639 (Insecure Direct Object Reference)
## Affected Systems
- **Products:** Spireon (now LoJack) Kahu aftermarket telematics devices and dealer management software.
- **Versions:** All versions prior to the July 2026 remediation.
- **Configurations:** Vehicles where dealerships installed "add-on" alarm or tracking systems (often pre-installed for lot management) that remain active or powered on, even if the consumer did not subscribe to the service.
## Vulnerability Description
The flaw resides in the cloud-based API and web dashboard used by dealerships to manage vehicle inventory. Researchers discovered that the platform suffered from broken authentication and authorization. By manipulating API requests, an attacker could bypass login requirements or escalate privileges to a "super-admin" level. This allowed unauthorized access to the entire fleet of vehicles equipped with the hardware, regardless of whether the owner was a paying subscriber.
## Exploitation
- **Status:** PoC available (demonstrated by security researchers); no confirmed wide-scale exploitation in the wild at the time of the report.
- **Complexity:** Low
- **Attack Vector:** Network (Remote over the internet)
## Impact
- **Confidentiality:** High (Real-time GPS tracking and access to owner PII)
- **Integrity:** High (Remote command execution to unlock/lock doors)
- **Availability:** High (Ability to activate "starter disable" features, effectively bricking the vehicle)
## Remediation
### Patches
- **Cloud-side Update:** The vendor (LoJack/Spireon) has reportedly issued server-side patches to validate API calls and enforce strict authorization. No hardware replacement is required as the fix is applied to the central management platform.
### Workarounds
- **Physical Removal:** Owners can choose to locate the aftermarket device (typically tucked under the dashboard or connected to the OBD-II port) and physically disconnect it.
- **Account Verification:** Ensure that any active Kahu/LoJack accounts have strong, unique passwords and MFA enabled, though this does not mitigate API-level flaws.
## Detection
- **Indicators of Compromise:** Unusual behavior such as spontaneous door unlocking or the vehicle failing to start without an obvious mechanical cause.
- **Detection Methods:** There are currently no consumer-facing tools to detect API-level exploitation. Owners can check for the presence of the hardware (often a small black box spliced into the wiring harness) to identify if their vehicle is within the affected fleet.
## References
- **Vendor Advisory:** Spireon/LoJack Security Portal [hxxps://www.spireon[.]com/security]
- **Relevant Research:** Wired - A Device Hidden in Cars Across the US [hxxps://www.wired[.]com/story/a-device-hidden-in-cars-across-the-us-leaves-them-vulnerable-to-hacking-and-paralysis-patch-it-now/]