4 ms·

> November 3, 2025: Reported. > November 10, 2025: No response, followed up. > November 17, 2025: No response, followed up and copied some additional people o

> November 3, 2025: Reported. > November 10, 2025: No response, followed up. > November 17, 2025: No response, followed up and copied some additional people on the thread. > November 20, 2025: It was no longer possible to access any of the internal APIs. The primary vulnerability was now fixed. > July 27, 2026: Published Quite the generous timeline on this person's behalf.

greyface- 2mo ago
And terrible (non-)response from VECV, if they have any interest in receiving timely disclosure from future researchers.
deleted 2mo ago
[deleted]
r_lee 2mo ago
reminder, these vendors like Volvo etc., don't really want you to report vulns, you should just sell them to a broker instead and get some actual money as well, it's a win win.
- cromka 2mo ago
  reminder, Volvo is Chinese.
  - loloquwowndueo 2mo ago
    How so? Sources?
    - solarkraft 2mo ago
      Geely bought it from Ford in 2010. https://www.reuters.com/article/business/geely-signs-18-billion-deal-for-volvo-idUSTRE62Q1EH/ https://www.reuters.com/article/business/geely-signs-18-bill...
      - dhathorn 2mo ago
        That would be Volvo cars. tfa is about Volvo group, which is Swedish and makes among other things Volvo trucks. (Or HGVs as they might be called in Europe)
        cromka 2mo ago
        Oh, fair. I assumed this was consumer cars.
        solarkraft 2mo ago
        Oh, great point!
  - johanmrtnsn 2mo ago
    Are you thinking about Volvo cars? There are two Volvo companies, Volvo cars and Volvo group. This seems to be about Volvo group which makes commercial vehicles like trucks and busses.
    - ashu1461 2mo ago
      Also the exploit is not directly via volvo but with a third party
- mpdpsycho 2mo ago
  I don’t know why particularly here over elsewhere, but this thought really makes me feel disappointment in the whole chain of humans responsible for the cost optimization away of product integrity. Though in this case, with all the tracking being thrown into newer cars, maybe a bit of a gap is a good thing for the future. Jailbreaking vehicles would be a cool thing to see become widespread.
  - r_lee 2mo ago
    there's no point in being moral when these companies with their immense resources will just ignore you or refuse to give a measly bounty things won't change until they have to make an effort
    - voakbasda 2mo ago
      This. If they don’t feel pressure to pay, they won’t. More people should make them pay.

greyface- 2mo ago

And terrible (non-)response from VECV, if they have any interest in receiving timely disclosure from future researchers.

deleted 2mo ago

[deleted]

r_lee 2mo ago

reminder, these vendors like Volvo etc., don't really want you to report vulns, you should just sell them to a broker instead and get some actual money as well, it's a win win.

cromka 2mo ago
reminder, Volvo is Chinese.
- loloquwowndueo 2mo ago
  How so? Sources?
  - solarkraft 2mo ago
    Geely bought it from Ford in 2010. https://www.reuters.com/article/business/geely-signs-18-billion-deal-for-volvo-idUSTRE62Q1EH/ https://www.reuters.com/article/business/geely-signs-18-bill...
    - dhathorn 2mo ago
      That would be Volvo cars. tfa is about Volvo group, which is Swedish and makes among other things Volvo trucks. (Or HGVs as they might be called in Europe)
      - cromka 2mo ago
        Oh, fair. I assumed this was consumer cars.
      - solarkraft 2mo ago
        Oh, great point!
- johanmrtnsn 2mo ago
  Are you thinking about Volvo cars? There are two Volvo companies, Volvo cars and Volvo group. This seems to be about Volvo group which makes commercial vehicles like trucks and busses.
  - ashu1461 2mo ago
    Also the exploit is not directly via volvo but with a third party
mpdpsycho 2mo ago
I don’t know why particularly here over elsewhere, but this thought really makes me feel disappointment in the whole chain of humans responsible for the cost optimization away of product integrity. Though in this case, with all the tracking being thrown into newer cars, maybe a bit of a gap is a good thing for the future. Jailbreaking vehicles would be a cool thing to see become widespread.
- r_lee 2mo ago
  there's no point in being moral when these companies with their immense resources will just ignore you or refuse to give a measly bounty things won't change until they have to make an effort
  - voakbasda 2mo ago
    This. If they don’t feel pressure to pay, they won’t. More people should make them pay.