Researchers earned $886,250 for 49 zero-days during Pwn2Own Automotive 2025, held in Tokyo from January 22 to 24. Sina Kheirkhah of Summoning Team took the Master of Pwn title with $222,250 and 30.5 points. The contest tested electric-vehicle chargers, in-car infotainment systems and Automotive Grade Linux, demonstrating that automotive cybersecurity reaches beyond a vehicle’s drivetrain and into its connected equipment and cabin electronics.
How much did hackers win at Pwn2Own Automotive 2025?
Trend Micro’s Zero Day Initiative (ZDI) reported a total of $886,250 awarded for 49 zero-days over the three-day competition. ZDI’s final results distinguish successful unique findings from collisions, in which a bug was already known to another participant or otherwise not unique. The 49 figure is the official total of rewarded zero-days; it should not be read as 49 successful, entirely independent demonstrations across every attempt.
The event was the second annual automotive edition of Pwn2Own and took place at Automotive World in Tokyo. Trend Micro’s retrospective dates the competition January 22–24, 2025. The contest’s categories were electric-vehicle chargers, in-vehicle infotainment (IVI) and operating systems.
Who won Master of Pwn?
Sina Kheirkhah (@SinSinology) of Summoning Team won the overall Master of Pwn ranking with 30.5 points and $222,250 in prize money, according to ZDI’s final results. The title reflects the event’s points standings, while the dollar total is the prize attributed to Kheirkhah’s entries; it is not the total prize pool.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
- CarPlay and Android Auto: This plug-in device connects to your phone via Bluetooth and WiFi. To use CarPlay, connect an iPhone; to use Android Auto, connect an Android phone. Simply connect it to your smartphone and access map navigation, calling, email, notifications, music, and more.
- Online Maps and Real-Time GPS Navigation with Voice Control: When connected to a smartphone, the portable Apple CarPlay display delivers precise real-time positioning and zero-delay GPS navigation. Supports real-time navigation via apps like Google Maps and Waze (non-preinstalled apps require phone connection). Equipped with the latest voice control technology, it enables map navigation, calls, emails, notifications, music, and more through Siri/Google Assistant.
- OTA Updates: Keep your device up to date with over-the-air firmware updates, so you’re always one step ahead. This wireless CarPlay screen automatically pushes new system updates, ensuring long-term compatibility between your phone and Apple CarPlay, Android Auto, and other in-car electronics.
- Night Vision Backup Camera: A waterproof rear-view camera with night vision capabilities that connects to your in-car display. The backup camera accurately and clearly records your entire driving journey, providing you with comprehensive safety protection. The rear-view camera cable works in sync with your backup lights, making installation extremely convenient.
- Phone Mirroring Connection and Four Audio Outputs: This 9-inch CarPlay screen supports mirroring for both iOS and Android phones. The Q9S double-DIN car stereo integrates CarPlay functionality while supporting Bluetooth audio, built-in speakers, FM radio, and an AUX port. Enjoy clear, stable music even in noisy environments. Connecting your phone via Bluetooth to the car's Bluetooth system for audio playback through the car speakers is the optimal choice.
Which chargers, infotainment systems and operating system were targeted?
ZDI’s schedule and results named products and software in three target classes. These are contest targets, not a claim that every unit or installation of a product is vulnerable.
| Category | Named targets |
|---|---|
| EV chargers | Autel MaxiCharger AC Wallbox Commercial; ChargePoint Home Flex; Phoenix Contact CHARX SEC-3150; Ubiquiti Connect EV Station; WOLFBOX Level 2 EV Charger; Tesla Wall Connector |
| In-vehicle infotainment | Alpine iLX-507; Kenwood DMX958XR; Sony XAV-AX8500 |
| Operating system | Automotive Grade Linux |
The range matters: the contest covered charging equipment as well as systems installed in vehicles. Automotive Grade Linux was the named operating-system target; the results do not establish that all automotive Linux distributions or vehicles share the demonstrated issues.
Rank #2
- 【360 Rotation 4K Dash Cam】 4K front dash cam for ultra-clear recording. Antika Car Audio Receivers has a wide-angle lens and loop recording function. Easily adjust the camera angle vertically or rotated 360°. Even can rotate the front camera to record inside the carWith 64GB SD card, Car Play screen starts looping video and automatically overwrites earlier video (when the vehicle is in a collision, it automatically locks the video)
- 【IP65 Rear Camera &1080P Reversing Camera】1080P waterproof reversing camera for better visibility when parking. The rear camera is IP65 protection level, dustproof and rainproof, easy to cope with various working environments. After correctly installing the rear camera, when the car is in reverse gear, the Carplay screen automatically switches to the reverse image and displays the reversing auxiliary line, with a large screen and a wide-angle view, it is easy to reverse into the garage
- 【Real-Time Navigation】Antika wireless Carplay screen supports Carplayfor Apple cellphone and Android Auto for Android.Seamlessly accessing your smartphone's GPS app (Google Maps, Apple Maps, Waze, etc.) in real-time, giving you updated maps, providing a safer and intelligent driving experience.Once you connect your smartphone for the first time, this carplay screen for car will automatically reconnect every time you get in your car
- 【Wireless Mirror Link】Carplay screen for car supports mirror Link for Apple/iPhone and Android smartphones. Airplay for iPhnoe, Micracast for Android samrtphone syncing to start the mirror function.Casting video to the large 10.26-inch 2.5D IPS 4K screen, enjoy the ultra clear visual and crisp auditory experience like movies, YouTube Tictok videos, and more
- 【Superior Sound Quality】 This android auto screen is equipped with the latest Bluetooth 5.0 technology, delivering exceptional sound quality and a stable, lag-free connection without dropouts. Antika Apple carplay screen supports a variety of audio outputs, including Bluetooth transmission, FM transmission, AUX output and high-quality built-in speakers, providing you with flexible choices to enjoy your favorite music and audio content.
What kinds of exploits were demonstrated?
The published results describe several vulnerability types and, in some cases, chains that combined multiple bugs. Reported primitives included stack- and heap-based buffer overflows, OS command injection, integer overflow, hard-coded cryptographic keys and origin-validation errors. Demonstrations included code execution and signal manipulation through a charging connector.
Infotainment systems
- PCAutomotive demonstrated code execution on the Alpine iLX-507 using a stack-based buffer overflow.
- Viettel used OS command injection against the Kenwood DMX958XR.
- ANHTUD exploited an integer overflow in the Sony XAV-AX8500.
- Further final-day results included another Sony integer-overflow exploit, an Alpine stack-buffer-overflow exploit and Kenwood OS-command-injection exploits.
EV chargers
- Sina Kheirkhah combined three bugs against the Phoenix Contact CHARX SEC-3150. ZDI also recorded an origin-validation error against Phoenix Contact.
- Synacktiv combined a stack buffer overflow with a known OCPP bug against the ChargePoint Home Flex and demonstrated signal manipulation through the connector. The inclusion of a known bug is why collision status matters when interpreting an entry.
- PHP Hooligans used a heap-based buffer overflow against the Autel MaxiCharger AC Wallbox Commercial. A final-day Autel demonstration also used a buffer overflow and transmitted signals through the charging connector.
- A hard-coded cryptographic-key bug was reported against the Ubiquiti Connect EV Station. A later Ubiquiti chain combined three bugs, two of which were already known.
- ZDI’s final results also include a single-bug ChargePoint exploit.
Operating system
Automotive Grade Linux was exploited using multiple bugs. The event results identify the target and multi-bug nature of the demonstration, but the supplied public summary does not specify a more detailed vulnerability primitive for that entry.
Rank #3
- ⭐【Ultra-Slim 11” Wireless Apple CarPlay Screen – Market’s Largest Display】 Experience unmatched style with the IIWEY iK11 11-inch wireless CarPlay screen. Its ultra-slim profile and 1280×800 resolution set a new benchmark. ❗❗COMPACT CAR OWNERS: Due to the massive 11" size, dashboard mounting may block visibility in small vehicles. Please use the extended suction cup mount to adjust the position, or search ASIN: B0D9XGT534 for our iK7 model, tailored for smaller cars. ❗❗NOTE: Features an Auto Power System; it powers on/off automatically. No manual operation of the top switch is required.
- ⭐【Wireless Apple CarPlay & Android Auto – Add Smart Connectivity to Any Car】 Seamlessly integrate your smartphone with Apple CarPlay or Android Auto. The iK11 is ideal for anyone looking to add Apple CarPlay to any car, especially older vehicles without built-in infotainment. Enjoy safe, wireless access to apps, music, and messages—hands-free. ❗NOTE: We provide comprehensive instructional videos to easily guide you through all operations and setups.
- ⭐【Voice Control with Siri & Google Assistant – Smarter, Safer Driving】 This intelligent car stereo with Apple CarPlay supports full voice commands via Siri and Google Assistant. Manage navigation, calls, media, and more by voice—ensuring both safety and convenience on every drive.
- ⭐【1280x800 HD Touch Screen Car Stereo with Bluetooth & Wireless Mirroring】 Enjoy premium visuals on this touch screen car stereo, enhanced by Bluetooth support and wireless screen mirroring via AirPlay and Miracast. Whether you’re navigating or streaming, the iK11 delivers smooth performance and a truly modern interface.
- ⭐【4K Dashcam + 1080P Rear Camera – Portable CarPlay with Built-In 64GB Storage】 The iK11 comes equipped with a 4K front dashcam and 1080P rear camera, providing comprehensive road coverage in both directions. This portable CarPlay system includes a pre-installed 64GB high-speed memory card, ensuring you can record and store footage right out of the box. With Wi-Fi video transfer, reviewing or saving clips to your phone is effortless—ideal for safety, travel, and insurance needs.
How should “success,” “collision” and “zero-day” be read?
ZDI labels results “SUCCESS,” “SUCCESS/COLLISION” or “COLLISION.” A success indicates a qualifying demonstration; a collision indicates overlap with a previously known bug, so it is not equivalent to a wholly unique discovery. A multi-bug chain can also mix new and known issues, as in the Ubiquiti result where two of three bugs were already known. Read each entry’s status alongside its bug count rather than treating every exploit chain as a single new vulnerability.
The results show that researchers could reach meaningful behavior on specific contest targets, including code execution and connector-mediated signaling. They do not by themselves show that a vehicle was remotely compromised on public roads, that a charger fleet was broadly exposed, or that every product named has the same flaw. The published demonstrations are evidence about particular tested hardware and software under contest conditions.
Rank #4
- Krunia Anniversary Celebration Offer: Join our celebration! Purchase any Krunia product and email us at [email protected] to know the details on how to get one of these exciting gifts: a 256GB Memory Card or another CarPlay screen
- Wireless Apple CarPlay & Android Auto Screen: Enjoy seamless wireless carplay and android auto connectivity for hands-free calls, music, and messaging. Access real-time navigation via Apple Maps, Google Maps, or Waze with live traffic updates. This portable CarPlay screen for car ensures smooth voice control and effortless integration, making it a versatile car tablet for daily commutes
- Ultra-Fast Responsiveness: Powered by 5G Wi-Fi and bluetooth 5.0, this car play screen delivers 1.35x smoother performance and 25% faster touch response than competitors. Ideal for wireless carplay and android auto, it provides a lag-free experience, whether you're using GPS navigation or streaming audio through your car’s sound system
- Vivid IPS Touchscreen: Featuring 550 cd/m² brightness, 1000:1 contrast ratio, and 16.7 million colors, this car tablet reduces glare and offers 18% brighter visuals. Its vibrant, tablet-like display stands out from standard car screens, enhancing visibility for navigation and multimedia
- Crystal-Clear Resolution: With a 1600x600 resolution—one of the highest in carplay/android auto screens—this display provides up to 1.5x sharper clarity than rivals. Perfect for GPS navigation and backup camera views, it ensures every detail is crisp and easy to read
Why the results matter to drivers and charging operators
EV security depends on more than the vehicle itself. A charger is a connected device, an infotainment system is a computer in the cabin, and automotive operating systems form another layer of the software stack. Testing all three categories makes the competition useful as a snapshot of attack surfaces researchers can examine—not as a report of real-world attacks or a ranking of product safety.
For owners and operators, the practical response is to follow the relevant manufacturer’s security and software-update guidance for the specific model and installation. The contest summary does not provide a universal patch status or establish that a particular owner needs to replace equipment.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
- Upgrade your driving experience with our state-of-the-art IIWEY Ik7 car stereo, a perfect blend of modern technology and user-friendly design. Seamlessly integrate your smartphone with wireless Apple CarPlay and Android Auto, allowing for an intuitive connection that enhances both safety and convenience on the road.
- 【Intelligent Integration with Carplay/Android Auto】IIWEY iK7 features wireless Apple CarPlay and Android Auto, allowing voice control via Siri or Google Assistant. Navigate, make hands-free calls, manage emails, and enjoy music safely. This smart interface significantly boosts driving safety and comfort. Plus, enjoy seamless connectivity as the device automatically pairs with your phone after the first setup.
- 【Unmatched 10’’ Display with Airplay and Miracast】IIWEY iK7 car stereo's wireless CarPlay screen and Android Auto screen offer unmatched display capabilities with Airplay and Miracast screen mirroring. Enjoy your phone's content on a stunning 10-inch display, available in sleek black or pristine white to match your dashboard's style. With a 60Hz refresh rate and 1600x600 resolution, the visuals for navigation, streaming, and more are sharp and smooth.(Attn: the item size is 9.45*3.7 inch)
- 【4K Advanced Dashcam with Seamless Wifi Connectivity】IIWEY iK7 car stereo prioritizes safety and convenience with an integrated 4K dashcam. Capture high-resolution footage of the road ahead and your surroundings with the front and rear cameras. The wireless portable CarPlay screen allows for easy Wi-Fi connectivity, enabling instant downloading and sharing of footage to your smartphone. The included 64GB memory card provides ample storage for all your driving memories.
- 【Backup Camera with Enhanced Reverse Assist】Master reversing with confidence using our car stereo with backup camera. The 1080P rear camera activates automatically when shifting into reverse, offering a clear view with customizable guidelines. Adjust these guidelines to match your vehicle's dimensions for a precise and safe parking experience.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
