A vulnerability researcher named Eaton Zveare has published a report on his EatonWorks blog detailing how in October 2022 he was able to exploit a vulnerability in a Toyota employee logistics web application that allowed him to conduct a full takeover of the software anywhere it is used in the world. The software is known as the Global Supplier Preparation Information Management System (GSPIMS), and it allows Toyota employees and suppliers to coordinate logistics for parts, purchases, and projects. The vulnerability that Zveare exploited was in the GSPIMS application programming interface (API), and it allowed him to log in to GSPIMS as any corporate Toyota employee or supplier with only the knowledge of their company email address. Zveare alleges he was able to gain access to a directory of more than 14,000 users’ “Toyota projects, documents, and user accounts, including user accounts of Toyota’s external partners/suppliers.” The access gave him full visibility into employee and supplier account details, as well as “confidential documents, projects, supplier rankings/comments, and more.” In November 2022 Zveare reported the vulnerability to Toyota through its coordinated disclosure program, and the flaw was quickly patched. A Toyota spokesperson made a statement that there is no evidence that this vulnerability was ever exploited in-the-wild, and on his blog, Zveare applauded the company for having the “fastest and most effective” response to a security issue that he has ever reported. If exploited by threat actors, a flaw like this could cripple Toyota’s operations and allow for creating rogue administrative user accounts, as well as stealing intellectual property and dropping devastating malware in the GSPIMS networks. The flaw was remediated, and there is no further action that needs to be taken by Toyota employees and suppliers. CTIX analysts will continue to report on interesting zero-day vulnerabilities, and technical details of Zveare’s methods can be found in his blog post linked below.