Cybersecurity Risks in Software-Defined Vehicles: Critical Safety Systems Unpatchable Remotely

• •Many vehicle safety systems cannot be patched remotely, increasing vulnerability.
• •83% of automotive software developers expect major cyberattack risks in the next three years.
• •The PerfektBlue vulnerabilities highlighted the risks in infotainment systems but did not affect critical controls.

The eSync Alliance has warned that many safety-critical vehicle controllers, including those for braking and steering, cannot receive remote security updates, leaving cars vulnerable for extended periods. This situation arises as most over-the-air update systems are designed for infotainment and telematics, while critical controllers often come from different suppliers. A recent survey indicated that 83% of automotive software developers expect software-defined vehicles to be major targets for cyberattacks within three years. The PerfektBlue vulnerabilities, disclosed in 2025, demonstrated that attackers could exploit infotainment systems, but critical systems remain unpatched. The complexity of the supply chain has delayed security patches, with some manufacturers still unpatched nearly a year after fixes were made available. The eSync Alliance advocates for a standardized update system to address these vulnerabilities effectively.