# Eaton Works Feed Feed of news/blog postings on the Eaton Works website. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Tata's B2B platform returned OTPs in API responses DevFeed: [Tata's B2B platform returned OTPs in API responses]() Original publisher: [Read original article]() Author: Eaton Published: 2026-08-24T14:25:14Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [vulnerability](), [account takeover](), [API](), [Encryption](), [Binance]() Tags: [account-takeover](), [api](), [b2b](), [encryption](), [platform](), [vulnerability]() ### AI overview A security write-up describes a vulnerability in Tata nexarc that returned OTPs in API responses. Because the responses could be decrypted client-side, an attacker with a target's phone number could obtain the OTP and take over the account, including accounts with administrative privileges. ### Source excerpt Tata's nexarc platform had a vulnerability where OTPs could be decrypted from API responses, making it easy to take over any account. ## Exploiting Volvo/Eicher's fleet management platform to gain control over all users and vehicles DevFeed: [Exploiting Volvo/Eicher's fleet management platform to gain control over all users and vehicles]() Original publisher: [Read original article]() Author: Eaton Published: 2026-07-27T14:31:47Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [vulnerability](), [Exploit](), [account takeover](), [API](), [Security](), [data](), [App](), [Website](), [Android](), [iphone]() Tags: [account-takeover](), [android](), [api](), [app](), [automotive](), [data](), [india](), [iphone](), [security](), [vulnerability]() ### AI overview The article reports vulnerabilities in VE Commercial Vehicles' My Eicher fleet-management platform that exposed hidden unauthenticated APIs and could enable account takeover and control of users' vehicle fleets. It also describes potentially exposed customer, user, vehicle, and identity-document data. A July 28, 2026 update says the concerns were remediated in coordination with the VECV team and that there was no current threat to customers or vehicles. ### Source excerpt VE Commercial Vehicles' My Eicher platform had a critical vulnerability that let you take over anyone's account and gain control over their vehicle fleets. ## Inside an AI coal mine security camera network powered by plaintext passwords DevFeed: [Inside an AI coal mine security camera network powered by plaintext passwords]() Original publisher: [Read original article]() Author: Eaton Published: 2026-07-08T17:07:38Z Content type: opinion Language: en Sources: [Eaton Works Feed]() Topics: [Security](), [Vulnerabilities](), [API](), [passwords](), [spoofing](), [JavaScript]() Tags: [api](), [breach](), [browser](), [chrome](), [javascript](), [passwords](), [security](), [spoofing](), [vulnerabilities]() ### AI overview This security write-up examines Coal India's Project DigiCoal camera-monitoring platform, developed by DeepSight AI Labs and Accenture. It reports that the RPI Dashboard exposed user accounts and plaintext, weak, duplicated passwords through an unauthenticated API. The article also describes bypassing client-side access controls to view camera alerts and feeds across seven coal mines. ### Source excerpt Coal India's intelligent CCTV platform developed by DeepSight AI Labs and Accenture had plaintext passwords and no API authentication. ## Exploiting vulnerabilities in Johnson & Johnson web apps DevFeed: [Exploiting vulnerabilities in Johnson & Johnson web apps]() Original publisher: [Read original article]() Author: Eaton Published: 2026-06-24T16:11:49Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Vulnerabilities](), [API keys](), [Web](), [web applications](), [audit](), [Authentication](), [data](), [Microsoft](), [Amazon Web Services]() Tags: [api](), [apis](), [audit](), [authentication](), [aws](), [data](), [microsoft](), [vulnerabilities](), [vulnerability](), [web](), [web-apps]() ### AI overview The article reports vulnerabilities in two Johnson & Johnson web applications. A campus recruiting application exposed student information because its APIs used a hardcoded AWS API key instead of the Microsoft SSO token. The article also reports a vulnerability in the Audit Tracking Management System involving confidential internal audit data. ### Source excerpt Campus Recruiting vulnerability exposed student information, and Audit Tracking Management System vulnerability exposed confidential internal audit data. ## Using cookies to hack into a tech college's admission system DevFeed: [Using cookies to hack into a tech college's admission system]() Original publisher: [Read original article]() Author: Eaton Published: 2026-03-09T13:41:25Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Security](), [Web app](), [API](), [Authentication](), [Vulnerabilities](), [JavaScript](), [HTTP]() Tags: [api](), [authentication](), [cookies](), [data](), [http](), [india](), [javascript](), [security](), [vulnerability](), [web](), [web-app]() ### AI overview The article describes how missing authentication on SKCET's admission APIs allowed manual cookie manipulation to bypass login and impersonate an admission officer. By discovering an officer GUID through student searches, the author accessed reports containing sensitive information about 4,110 students, including contact, address, Aadhaar, medical, demographic, academic, and income data. ### Source excerpt The Sri Krishna College of Engineering and Technology (SKCET) in India made elementary mistakes in web app security. ## Insecure Dava India Pharmacy APIs Exposed Super Admin Users and Enabled Privileged Account Creation DevFeed: [Insecure Dava India Pharmacy APIs Exposed Super Admin Users and Enabled Privileged Account Creation]() Original publisher: [Read original article]() Author: Eaton Published: 2026-02-14T03:07:20Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Exploit](), [Hacking](), [Website](), [account](), [password reset](), [passwords](), [Next.js]() Tags: [account](), [exploit](), [hacking](), [next-js](), [password](), [website]() ### AI overview A security write-up describes insecure super-admin APIs on Dava India Pharmacy's website. The APIs exposed a list of super-admin users without authentication, and testing indicated that creating a super-admin account was a supported operation. ### Source excerpt Super admin exploit on Dava India Pharmacy's website gave complete control over everything. ## Security vulnerabilities in Bluspark Global's BLUVOYIX ocean logistics platform DevFeed: [Security vulnerabilities in Bluspark Global's BLUVOYIX ocean logistics platform]() Original publisher: [Read original article]() Author: Eaton Published: 2026-01-14T15:05:15Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Security](), [Vulnerabilities](), [Authorization](), [passwords](), [API](), [Binance](), [Software as a service](), [data]() Tags: [api](), [authorization](), [code](), [cve](), [passwords](), [saas](), [security]() ### AI overview An investigation into critical security vulnerabilities in Bluspark Global's BLUVOYIX ocean logistics platform, including unauthenticated APIs, exposed API documentation, self-created administrator accounts, phishing-capable email functionality, and plaintext password access. The article states that the issues were resolved by publication and that administrator access could expose and alter customer shipments. ### Source excerpt Exploring security blunders in Bluspark Global's BLUVOYIX, an ocean logistics / supply chain platform used by hundreds of the world's largest companies. ## Cracker Barrel rewards admin panel vulnerability allowed API requests without an authorization token DevFeed: [Cracker Barrel rewards admin panel vulnerability allowed API requests without an authorization token]() Original publisher: [Read original article]() Author: Eaton Published: 2025-11-17T15:31:02Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [vulnerability](), [Authorization](), [Exploit](), [api server](), [React]() Tags: [admin](), [api](), [api-server](), [auth](), [authorization](), [bypass](), [panel](), [react](), [third-party](), [vulnerability]() ### AI overview The article describes a vulnerability in Cracker Barrel's rewards administration system. The author found that the React app's API server accepted requests without an authorization token, potentially allowing access to rewards management functions. No write actions were performed, no sensitive information was exposed, and the vulnerability appeared to be fixed by November 17, 2025. ### Source excerpt Cracking open the rewards admin panel. ## Hacking India's largest automaker: Tata Motors DevFeed: [Hacking India's largest automaker: Tata Motors]() Original publisher: [Read original article]() Author: Eaton Published: 2025-10-29T01:05:40Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Hacking](), [Vulnerabilities](), [Amazon Web Services](), [Amazon S3](), [API keys](), [data](), [Encryption]() Tags: [amazon](), [aws](), [credentials](), [database](), [encryption](), [hacking](), [india](), [s3](), [vulnerabilities]() ### AI overview The article describes four security findings involving Tata Motors discovered in 2023. It reports that exposed AWS keys on public-facing websites enabled access to sensitive information across many S3 buckets, that weakly encrypted keys could be decrypted, that a Tableau backdoor allowed passwordless login as users including an administrator, and that an exposed Azuga API key compromised a test-drive fleet management system. The author states that the disclosed credentials were rotated and that testing did not download substantial amounts of data or show obvious evidence of malicious access. ### Source excerpt Tata Motors gave away the keys to their infrastructure and customer data on their public websites. ## Vulnerabilities in a centralized automaker dealer platform enabled access to more than 1,000 US dealerships DevFeed: [Vulnerabilities in a centralized automaker dealer platform enabled access to more than 1,000 US dealerships]() Original publisher: [Read original article]() Author: Eaton Published: 2025-10-13T15:13:09Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [vulnerability](), [Exploit](), [Hacking](), [account]() Tags: [account](), [automotive-industry](), [hacking](), [us](), [vulnerabilities](), [vulnerability]() ### AI overview The article describes two vulnerabilities in a top automaker's centralized dealer platform: missing invite-token verification and a missing privilege check in account creation. The author states that these flaws enabled creation of a national admin account with access to systems across more than 1,000 US dealerships. ### Source excerpt On August 10, 2025 at DEF CON 33 in Las Vegas, I presented what could possibly be the biggest vulnerability I may ever discover in the automotive industry. Read and watch how I managed to take over a top automaker's entire dealer ecosystem. ## Taking remote control over industrial generators DevFeed: [Taking remote control over industrial generators]() Original publisher: [Read original article]() Author: Eaton Published: 2025-10-06T15:13:20Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [generators](), [Authorization](), [API](), [vulnerability](), [Security]() Tags: [api-security](), [apis](), [authorization](), [industrial](), [security](), [vulnerability]() ### AI overview An industrial generator management platform had insecure APIs that accepted valid user tokens without checking whether the user had administrator privileges. This broken function-level authorization could expose generator data and commands to start or stop generators. The commands were not tested because doing so could have created a safety hazard. ### Source excerpt Industrial generator smart platform had insecure APIs that could enable remote control by anyone. ## Intel Outside: Hacking every Intel employee and various internal websites DevFeed: [Intel Outside: Hacking every Intel employee and various internal websites]() Original publisher: [Read original article]() Author: Eaton Published: 2025-08-18T14:15:43Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Hacking](), [intel](), [hardcoded credentials](), [Vulnerabilities](), [Security](), [Exploit](), [Encryption](), [Authentication](), [Angular](), [Azure]() Tags: [angular](), [authentication](), [azure](), [credentials](), [encryption](), [exploit](), [hacking](), [hardcoded-credentials](), [intel](), [security-vulnerabilities]() ### AI overview This security investigation describes vulnerabilities in several internal Intel websites. The issues included bypassing corporate login controls, exploiting easily decryptable hardcoded credentials, and using client-side modifications to access employee and supplier information. ### Source excerpt Hardcoded credentials, pointless encryption, and generous APIs exposed details of every employee and made it possible to break into internal websites. ## API flaws in McDelivery India enabled discounted orders, order hijacking, and access to user information DevFeed: [API flaws in McDelivery India enabled discounted orders, order hijacking, and access to user information]() Original publisher: [Read original article]() Author: Eaton Published: 2024-12-19T13:00:22Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [API](), [Security](), [Web app](), [Website]() Tags: [api](), [bug](), [security](), [service](), [user](), [web-app]() ### AI overview A security disclosure describes API flaws in McDelivery India that enabled orders for INR 1, hijacking or redirecting other customers' deliveries, access to order details and invoices, order tracking, and exposure of sensitive driver information. ### Source excerpt A series of API flaws in McDelivery India made it possible to order food for a penny, hijack other people's delivery orders, view user information, and more. ## Honeywell BEDQ API Access Control Flaw Exposed an Internal Engineering System DevFeed: [Honeywell BEDQ API Access Control Flaw Exposed an Internal Engineering System]() Original publisher: [Read original article]() Author: Eaton Published: 2024-08-19T04:00:00Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [API](), [Security](), [Access Control](), [Angular](), [web applications]() Tags: [access-control](), [angular](), [api](), [api-security](), [security](), [web-apps]() ### AI overview The article describes how an insecure API endpoint in Honeywell's BEDQ system exposed an internal engineering application. It examines weaknesses in access control between internal users and externally registered Honeywell IDs, and emphasizes the need for stronger API security. ### Source excerpt (ASPEN) APIs are crucial for web apps but pose security risks. I uncovered a critical flaw in Honeywell's BEDQ system, highlighting the need for strong API security. ## Gaining admin access to a Siemens cloud system DevFeed: [Gaining admin access to a Siemens cloud system]() Original publisher: [Read original article]() Author: Eaton Published: 2024-07-31T04:00:00Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Security](), [Entra ID](), [React](), [Angular](), [JavaScript](), [web applications](), [Single-page application (SPA)](), [API](), [JSON Web Tokens](), [Single sign-on (SSO)]() Tags: [angular](), [api](), [api-discovery](), [authentication](), [authorization](), [javascript](), [jwt](), [react](), [security](), [sso](), [vulnerability]() ### AI overview The article examines a vulnerability in Siemens AMA Cloud, a React-based cloud application. It explains how insufficient server-side authentication and reliance on client-side controls can expose APIs and allow manipulation of the application's authentication flow, including its Microsoft SSO redirect and JWT handling. ### Source excerpt (ASPEN) Understanding the Risks of Client-Side Authentication: Why relying on client-side security isn't enough. ## Lessons in Securing Mobility Site Management APIs DevFeed: [Lessons in Securing Mobility Site Management APIs]() Original publisher: [Read original article]() Author: Eaton Published: 2024-05-16T04:00:00Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Mobile](), [vulnerability](), [API](), [Security](), [Exploit](), [PHP](), [Authentication](), [Single sign-on (SSO)]() Tags: [apis](), [authentication](), [mobile](), [network](), [php](), [security](), [sso](), [vulnerability]() ### AI overview This article examines vulnerabilities in the PHP APIs behind Johnson & Johnson's Mobility Service Portal. Researchers reported that the vulnerabilities allowed access to details about employee corporate devices, and Johnson & Johnson remediated the issue after receiving the report. ### Source excerpt (ASPEN) Mobile device management (MDM) systems are essential for large enterprises to track devices accessing the corporate network and ensure security. Read how a vulnerability on Johnson & Johnson's Mobility Service Portal made it possible to access employee corporate devices. ## Angular-ing for AuthZ, Problematic anti-patterns in Single Sign On Systems DevFeed: [Angular-ing for AuthZ, Problematic anti-patterns in Single Sign On Systems]() Original publisher: [Read original article]() Author: Eaton Published: 2024-03-05T05:00:00Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Single sign-on (SSO)](), [authz](), [vulnerability](), [Angular](), [API keys](), [API]() Tags: [angular](), [api](), [authentication](), [authz](), [security](), [sso](), [vulnerability]() ### AI overview The article describes an ASPEN team's research into an SSO login-flow flaw in an Angular application at a Fortune 500 healthcare company. It explains that exposed client-side API credentials and a user-search API accepting the value "all" enabled retrieval of user information; the reported vulnerability was resolved and mitigated. ### Source excerpt (ASPEN) A critical SSO vulnerability in a Fortune 500 app risked millions of records. Learn about SSO security risks, fixes, and protecting APIs from similar attacks. ## Hacking into a Toyota/Eicher Motors insurance company by exploiting their premium calculator website DevFeed: [Hacking into a Toyota/Eicher Motors insurance company by exploiting their premium calculator website]() Original publisher: [Read original article]() Author: Eaton Published: 2024-01-17T16:25:39Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Hacking](), [API](), [Cloud](), [Microsoft](), [passwords](), [Authentication](), [Website]() Tags: [api](), [authentication](), [broker](), [cloud](), [hacking](), [india](), [insurance](), [microsoft](), [password]() ### AI overview A security report describes how a vulnerable API on Toyota Tsusho Insurance Broker India's premium calculator website exposed Microsoft corporate cloud credentials. The exposed account lacked two-factor authentication and contained customer emails, insurance documents, password reset links, and OTPs. Other Microsoft cloud resources were also accessible. ### Source excerpt A vulnerable API on Toyota Tsusho Insurance Broker India's premium calculator website exposed Microsoft corporate cloud credentials. ## CVE-2023-6483: Improper/missing API authentication in ADiTaaS v5.1 DevFeed: [CVE-2023-6483: Improper/missing API authentication in ADiTaaS v5.1]() Original publisher: [Read original article]() Author: Eaton Published: 2023-12-18T15:52:29Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [API](), [Authentication](), [Security](), [Vulnerabilities](), [Hacking](), [Software as a service](), [Angular](), [.NET]() Tags: [angular](), [api](), [authentication](), [backend](), [cloud](), [cve](), [cybersecurity](), [digital](), [hacking](), [on-prem](), [security](), [vulnerabilities]() ### AI overview This article examines CVE-2023-6483, a critical API authentication flaw in ADiTaaS v5.1, now Digital Desk. The vulnerability allowed system administrator access by using an administrator user ID in the URL. The article describes responsible disclosure, remediation completed by December 1, 2023, and the range of organizations that could have been affected. ### Source excerpt The story of CVE-2023-6483, my first CVE and biggest security disclosure yet. ## Tapping into a telecommunications company's office cameras DevFeed: [Tapping into a telecommunications company's office cameras]() Original publisher: [Read original article]() Author: Eaton Published: 2023-11-14T18:53:08Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [API](), [vulnerability](), [React](), [Authentication](), [JSON]() Tags: [api](), [authentication](), [exploit](), [incident](), [json](), [react](), [reporting](), [vulnerability]() ### AI overview An unauthenticated API endpoint in a telecommunications company's office camera platform exposed a live image stream. The article describes how the endpoint was found, the read-only privacy impact, and the company's incident-reporting timeline. ### Source excerpt API flaw enabled livestreaming of a telecommunications company's office cameras. ## Compromising Honda's power equipment / marine / lawn & garden dealer eCommerce platform through a vulnerable password reset API DevFeed: [Compromising Honda's power equipment / marine / lawn & garden dealer eCommerce platform through a vulnerable password reset API]() Original publisher: [Read original article]() Author: Eaton Published: 2023-06-06T15:33:57Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [API](), [password reset](), [vulnerability](), [Website](), [data]() Tags: [api](), [data](), [ecommerce](), [password-reset](), [vulnerability](), [website]() ### AI overview A writeup describes compromising Honda's power equipment, marine, and lawn-and-garden dealer eCommerce platform through a vulnerable password reset API and broken access controls. The reported access included customer orders, dealer websites and accounts, email records, and potentially payment-related keys and internal financial reports. The incident did not affect Honda's automobile business. ### Source excerpt A vulnerable password reset API made it possible to take over any account and gain admin-level access to the platform. In addition, broken/missing access controls made it possible to access all data on the platform. ## Insecure Toyota CRM exposed Mexican customer information DevFeed: [Insecure Toyota CRM exposed Mexican customer information]() Original publisher: [Read original article]() Author: Eaton Published: 2023-03-06T17:52:27Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Security](), [Web app](), [Angular](), [API](), [Authentication](), [data](), [Development]() Tags: [angular](), [api](), [authentication](), [data](), [security](), [web-app]() ### AI overview A security writeup describes how Toyota's C360 CRM for Mexican customers could be accessed by bypassing its corporate login and switching a development app to the production API. The exposed unauthenticated API returned customer information, and Toyota fixed the issue after responsible disclosure. ### Source excerpt Breaking into a Toyota CRM and exploiting it to view customer information. ## Hacking into Toyota's global supplier management network DevFeed: [Hacking into Toyota's global supplier management network]() Original publisher: [Read original article]() Author: Eaton Published: 2023-02-06T16:22:56Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [backdoor](), [Hacking](), [Security](), [Vulnerabilities](), [Web app](), [account]() Tags: [account](), [backdoor](), [data](), [exploit](), [hacking](), [vulnerabilities](), [web-app]() ### AI overview A security researcher describes exploiting Toyota's Global Supplier Preparation Information Management System (GSPIMS), a web application used by Toyota employees and suppliers. An accidentally introduced backdoor in an impersonation feature enabled login as users, including administrators, using only their email addresses. The researcher reported the issue to Toyota in November 2022, and Toyota fixed it in a timely manner. ### Source excerpt Inside an exploit that allowed logging in to Toyota's GSPIMS application as any user, including system admins. ## Syndication feed now available DevFeed: [Syndication feed now available]() Original publisher: [Read original article]() Author: Eaton Published: 2023-01-28T17:38:46Z Content type: release Language: en Sources: [Eaton Works Feed]() Topics: [Atom Feed](), [Atom](), [RSS]() Tags: [announce](), [rss](), [syndication]() ### AI overview The site now provides an Atom syndication feed. New posts will be added automatically when published, and the feed is intended to work with compatible readers. ### Source excerpt An Atom feed is now available for the site. [Next page]()