Yes—but only in a specific research configuration, and the headline needs careful qualification. In 2025, automotive security firm PCAutomotive reported that it had compromised the infotainment system of a 2020 second-generation Nissan Leaf ZE1. The researchers described access to location data and the cabin microphone, control of the display and audio system, and a path from the infotainment ECU into vehicle networks. Secondary reporting on the controlled demonstration described commands affecting body functions and steering-related systems.
This was not proof that every Nissan Leaf could be remotely driven, nor evidence of an active attack campaign against ordinary owners. The work concerned a particular vehicle, infotainment ECU, firmware, and set of attack conditions. It is best understood as a demonstration of how Bluetooth, infotainment vulnerabilities, gateway protections, and connected-vehicle systems can be chained together.
As an Amazon Associate I earn from qualifying purchases.
The 2025 work is also separate from the better-known 2016 NissanConnect EV incident, which exposed telemetry and remote comfort features through an inadequately protected backend API but did not compromise steering or the vehicle’s internal infotainment-to-CAN path.
What PCAutomotive demonstrated
The research focused on a 2020 second-generation Nissan Leaf ZE1 fitted with a Bosch-manufactured infotainment ECU. PCAutomotive examined firmware version 283C30861E and an infotainment system with Bluetooth, Wi-Fi, and USB interfaces. That ECU was also connected to other vehicle computers over CAN buses.
#1 Best Overall
- 2 Stage Shock Sensor
- Door, Bonnet & Boot Protection
- Engine Immobilization
- Parking Light Flash (Arm, Disarm & Trigger)
- Keyless Entry
The researchers reported vulnerabilities that could provide code execution inside the infotainment environment and a route into parts of the vehicle network that should be isolated from an entertainment system. Their test bench included the infotainment unit, gateway, body-control module, instrument cluster, and wiring harness.
In broad terms, the reported chain was:
- Obtain an initial foothold through an exposed or abused vehicle interface, such as Bluetooth or another connected service.
- Compromise the infotainment software using flaws in Bluetooth handling or supporting services.
- Bypass security boundaries separating the infotainment ECU from other in-vehicle networks.
- Send commands across connected vehicle systems, including body-control functions and other electronic modules.
- Use cellular or internet-connected components for reachability where the vehicle configuration and attack conditions allowed it.
PCAutomotive also stated that an attacker could pair with the head unit through its Bluetooth menu without obvious owner interaction beyond selecting Add New. That makes proximity and initial-access conditions important. It does not mean that an attacker can instantly connect to every Nissan Leaf from anywhere on the internet.
What the CVEs covered
PCAutomotive’s March 6, 2025 advisory lists CVE-2025-32056 through CVE-2025-32063. The vulnerability family included several different weaknesses rather than one universal “Leaf hack.” The advisory described findings involving:
Free tools Windows power users keep installed
One-click scans. No signup required.
- an anti-theft protection bypass;
- misconfigured TLS communication in a Redbend service;
- multiple stack-overflow vulnerabilities;
- missing verification of Linux kernel-module signatures; and
- a configuration weakness that enabled SSH.
One request-processing vulnerability received a critical CVSS score of 9.3. Several Bluetooth-related issues were rated high at CVSS 8.8. A CVSS score describes the severity and exploit characteristics of a vulnerability; it is not a measurement of how many vehicles were attacked or proof that exploitation is occurring in the wild.
The National Vulnerability Database lists CVE-2025-32056 in connection with the head unit’s anti-theft mechanism and identifies the 2020 Nissan Leaf ZE1 as the first affected vehicle examined. NVD records a partial technical impact rather than labeling the issue a universal vehicle-takeover vulnerability. PCAutomotive’s advisory is the more useful source for understanding the full group of findings and the tested configuration.
What “remote spying” means in this case
The surveillance concern is based on capabilities PCAutomotive reported during its research, not on evidence that Nissan routinely recorded every owner. The researchers reported access to:
- Location information, which could expose where a vehicle is or has been;
- the cabin microphone, creating a potential eavesdropping risk; and
- the audio system, allowing sound to be played through the vehicle.
That combination creates a meaningful privacy and harassment risk even if an attacker never affects steering, braking, or propulsion. A compromised connected car can become a mobile sensor and speaker, not merely a target for remote climate commands.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- Universal car auto burglar alarm protection security system,with the basic keyless entry function. such as remote control lock/unlock door, trunk release, trunk release.
- Multi-level security arming & high reliability and quality.
- Car Alarm system with transponder to arm or disarm your car easily & improve vehicle safety
- Equipped with 2 Remote Controls, a Siren and wiring harness, etc.
- Can be used in different types of cars.
The careful wording is potential remote surveillance capability demonstrated by researchers. The available evidence does not establish an active campaign against ordinary Leaf owners, nor does it show that Nissan itself exposed every driver’s conversations.
What “physical takeover” does—and does not—mean
Secondary reporting on PCAutomotive’s Black Hat Asia 2025 presentation described demonstrations involving the horn, mirrors, windows, lights, wipers, locks, and other body functions. Reports also described steering-related manipulation in the controlled demonstration.
Those results matter because they show that a compromise beginning in an infotainment ECU could affect electronic systems beyond the screen and speakers. But “physical takeover” is easy to overstate. The public evidence does not justify saying that researchers demonstrated:
- unrestricted autonomous driving;
- the ability to safely drive a Leaf anywhere;
- universal control of every safety-critical system;
- a confirmed braking takeover; or
- a production-world attack against all Nissan Leaf vehicles.
“Steering-related control” should therefore be read as a serious controlled-test result, not as proof that an attacker could reliably operate a car like a remote-control vehicle in traffic. The exact result depends on the vehicle’s electronic architecture, software, connectivity, attack preconditions, and the protections present in that particular configuration.
Why the attack was more serious than an ordinary infotainment bug
Modern vehicles contain multiple electronic networks. The infotainment computer handles screens, audio, navigation, wireless connections, and user-facing services. Other modules manage functions such as locks, windows, lighting, instruments, body controls, and safety-related systems. Gateways and network segmentation are intended to prevent a compromise of the entertainment system from becoming a compromise of the vehicle.
The Leaf research is significant because it examined what happened when those boundaries could be weakened or bypassed. An attacker did not need to begin by directly attacking the body-control module. The proposed path began with a more exposed computer and then moved deeper into the vehicle’s internal network.
This is also why a generic Bluetooth security tip or a replacement screen is not a reliable fix. The issue is a chain involving wireless interfaces, infotainment software, operating-system protections, gateway behavior, CAN-connected modules, and possibly cellular or cloud-connected reachability.
Rank #3
- 2-in-1 Car Security Alarm: This upgraded vehicle vibration sensor alarm features a dual-alert system with a 120dB ultra-loud siren and high-intensity red strobe lights to maximize theft prevention. The system remains on alert once armed, activating full alarms (siren + strobe) only if the vehicle is disturbed.
- 3D Motion Sensor + AI Algorithm: Electop alarm system for car security with AI reduces false alarms while responding to real threats. Light taps trigger warning sirens + strobes. Forced entry attempts activate full car-grade alarms with intense flashing to scare thieves and alert bystanders
- Upgraded ring-shaped strobe design:The newly upgraded ring-shaped strobe light delivers 360° high-intensity illumination, creating 2X more visible warning signals. More eye-catching and brighter than standard single-point lights for maximum theft deterrence
- Upgraded 3-level alarm: This car vibration alarm with 3 adjustable volume levels (Max 120dB/Mid 110dB/Min 100dB) delivers ear-piercing theft deterrence - louder than car horns and construction noise to scare off intruders instantly.【Note】Vehicle soundproofing may muffle alarms, but our dual sound & light system ensures reliable protection
- Upgraded battery endurance: This car alarm system features a high-capacity lithium-ion battery that delivers over 3 months of continuous operation for the main unit, and up to 6 months of standby time, 2 years of battery life for the remote control, eliminating the need for frequent recharging
The 2016 NissanConnect EV problem was different
Nissan had already faced a separate connected-car security incident in 2016. Troy Hunt and Scott Helme reported that requests to the NissanConnect EV service could be made using a Leaf’s vehicle identification number without adequate authentication.
Recommended Free Tools
That flaw exposed information and comfort controls associated with the mobile service. Reports described access to another Leaf’s battery status and trip-history data, along with the ability to activate climate-related functions such as heating, fans, and air conditioning. Nissan disabled the app while investigating. Nissan said the affected functions were controlled through the phone service and that critical driving elements were not compromised.
| Incident | Initial access | Reported impact | What it did not show |
|---|---|---|---|
| 2016 NissanConnect EV | Unauthenticated or inadequately authenticated mobile-service/API requests using a VIN | Battery and trip information; remote climate and other comfort functions | Infotainment ECU compromise, CAN-network movement, or steering control |
| 2025 PCAutomotive research | Wireless and infotainment attack surfaces in a tested 2020 Leaf configuration, with a possible connected-vehicle path | Reported access to location, microphone, audio, display, body functions, and steering-related controls in a controlled demonstration | Universal remote driving, every Leaf model, or evidence of an active attack campaign |
The distinction is important. The 2016 issue was primarily a telematics and backend authentication failure. The later research involved compromise of an infotainment ECU and movement across in-vehicle networks. Treating the two incidents as the same “Nissan Leaf hack” obscures the much more important architectural lesson from the 2025 work.
Disclosure timeline
The dates also separate discovery from publication and public awareness:
- August 2, 2023: PCAutomotive says it sent its advisory to Nissan’s cybersecurity team.
- January 2024: The researchers supplied a full-attack demonstration and received confirmation from Nissan.
- September 2024: The advisory records communication with Bosch PSIRT.
- Later in 2024: The researchers coordinated CVE registration with MITRE and Bosch PSIRT.
- March 6, 2025: PCAutomotive publicly released the advisory.
- Black Hat Asia 2025: The research and demonstrations received broader public attention through conference reporting.
Responsible disclosure does not by itself tell owners whether a particular car has been updated. It does show that discovery, vendor confirmation, coordination, CVE assignment, and public reporting were separate stages.
Which Nissan Leafs are affected?
There is no sound basis for saying that every Nissan Leaf is affected by every CVE in the advisory. PCAutomotive’s central tested configuration was a 2020 Leaf ZE1 with the specified Bosch infotainment system and firmware. The advisory also discusses older firmware versions in connection with particular weaknesses, but that does not establish identical exposure across every year, market, trim, ECU supplier, or software release.
Owners should treat the following details as relevant when checking their vehicle:
Rank #4
- -Way Security + Remote Start System with 5-Button LCD Transmitter
- 5-button sidekick remote control transmitter
- 1 mile range
- 4-Channel vehicle security system
- Door and trunk triggers
- model year and generation;
- country or regional configuration;
- infotainment ECU supplier and hardware;
- currently installed infotainment firmware;
- vehicle connectivity and cellular-service status; and
- any Nissan or dealer remediation applied to the vehicle.
The exact firmware examined by PCAutomotive was 283C30861E. That is a useful identification detail, not a shortcut for declaring every Leaf running a different version safe or unsafe. A vehicle owner who needs a definitive answer should obtain the software and ECU information for the specific car and ask Nissan or an authorized service center whether an applicable campaign, firmware update, or technical service instruction exists.
Does Nissan’s app transition fix the problem?
No. Nissan’s connected-service changes and the infotainment vulnerabilities are related only in the broad sense that both involve connected vehicles.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Nissan’s U.S. materials describe remote Leaf features such as battery status, remote charging, and remote climate control. Nissan says the 2026 Leaf uses the MyNISSAN app, while 2025 and earlier Leafs use the NissanConnect EV & Services app.
Separately, Nissan Ireland stated that the legacy NissanConnect EV app would cease operation on March 30, 2026 for affected older Leaf and e-NV200 vehicles. Remote charging control, battery status, and remote climate control through that legacy app ended there, while in-car charging and climate timers remained available.
That Ireland notice is a regional service-lifecycle change. It should not be described as confirmation that the 2025 infotainment vulnerabilities were patched. An app shutdown can remove a cloud feature without changing the firmware, Bluetooth stack, Linux configuration, gateway behavior, or CAN-connected systems inside the car.
What Nissan Leaf owners should do
- Identify the exact vehicle. Record the model year, market, trim, infotainment hardware if available, and current software or firmware version. Do not assume that a different year or app version has the same exposure.
- Check official Nissan guidance. Use Nissan’s owner resources or an authorized dealer to ask about applicable infotainment software updates, campaigns, and the CVE family reported by PCAutomotive. A dealer may need to identify the head unit and read its software rather than relying on the vehicle’s model year alone.
- Do not install unofficial firmware. Avoid DIY flashing, modified infotainment images, anti-theft bypasses, or instructions that send commands directly onto the vehicle network. Those actions can create safety, warranty, and legal problems and can make diagnosis harder.
- Review wireless connections. Remove unfamiliar Bluetooth pairings if the vehicle’s documented settings allow it, decline unexpected pairing requests, and avoid unknown USB devices. These are sensible exposure-reduction steps, not a confirmed patch for the reported vulnerabilities.
- Be cautious about connectivity assumptions. A discontinued mobile app does not prove that the infotainment ECU is repaired. Conversely, an active app does not by itself prove that the specific research chain is exploitable.
- Document suspicious behavior. Unexpected pairing prompts, unexplained screen or audio activity, unfamiliar devices, or unusual vehicle behavior should be recorded and reported to Nissan or a qualified service provider. If the vehicle behaves unsafely, stop using it and seek professional assistance.
- Do not try to reproduce the demonstration. The public research may contain exploit material, but attempting it on a vehicle can affect safety-critical systems. This article intentionally does not provide payloads, CAN commands, Bluetooth exploit steps, or anti-theft bypass instructions.
The larger lesson for connected cars
The Leaf research illustrates why connected-car security cannot be reduced to protecting a phone app. The attack surface may include:
Best Value
- [MULTI-PURPOSE ALARM] Vibration sensor alarm not only suitable for Electric Bike, Motorcycles, Scooter, Car, Trailer, Golf Car, a must have bike motorcycle accessories, but also suitable for Mailbox, Luggage, Doors and Windows, a effectively anti theft device
- [REMOTE CONTROL & WATERPROOF] Wireless control by remote, strong wireless range up to 328ft. Vehicle search function/Remote noise maker, easy to find your vehicles in parking lot or make noise when you need, 3 kinds of bell sounds for your choice. IP65 waterproof, suitable for outdoor use
- [ADJUSTABLE VOLUME & ADJUSTBALE SENSITIVITY] 3 lever adjustable volume, don’t worry about the alarm is extremely loud or not loud. 7 level adjustable sensitivity from gently touch to push or beat, easy to set it as your need
- [LOUD ALARM & GREAT PERFORMANCE] Up to 113dB LOUD alarm, scare off potential thieves effectively. Well-made process, 4th version battery saving technology and updated senser technology let this anti theft alarm has great quality performance
- [SOS FUNCTION & EASY TO INSALL] Using mature motion algorithms and accurate senser, the alarm will automatically go off for calling help when you fell down.You can set the SOS function on or off. Super easy installation by pasting with double-sided sticker and tying it with strap
- mobile applications and cloud APIs;
- cellular modems and remote services;
- Bluetooth, Wi-Fi, and USB interfaces;
- infotainment operating systems and third-party services;
- kernel and boot-security controls;
- vehicle gateways and CAN buses; and
- body, instrument, and other electronic control modules.
A weakness in any one layer may be limited on its own. The risk grows when several weaknesses can be chained to cross a boundary that was supposed to protect vehicle functions. That is the important finding here: not that every Nissan Leaf is an internet-controlled car, but that a compromised infotainment ECU can have consequences well beyond entertainment when isolation and authentication fail.
Frequently Asked Questions
Can hackers remotely drive every Nissan Leaf?
No. The research did not show that every Nissan Leaf can be remotely driven. PCAutomotive focused on a 2020 second-generation Leaf ZE1 with a specific Bosch infotainment ECU and examined firmware version 283C30861E. Public reporting described steering-related manipulation in a controlled demonstration, but not unrestricted autonomous driving, universal braking control, or safe remote operation of every Leaf.
Was the 2016 Nissan Leaf app bug the same as the 2025 hack?
The 2016 incident involved NissanConnect EV’s backend API and inadequate authentication using a Leaf’s VIN. It exposed telemetry and comfort features such as battery status, trip information, climate control, fans, and seat heating. The 2025 research involved a compromised infotainment ECU and movement across in-vehicle networks, making it materially more serious and technically different.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Did Nissan’s app shutdown fix the Leaf infotainment vulnerabilities?
No. Nissan Ireland’s notice about the legacy NissanConnect EV app ending on March 30, 2026, was a regional connected-service sunset. Removing remote app features does not demonstrate that infotainment firmware, Bluetooth handling, Linux protections, gateway behavior, or CAN-network exposure were patched.
Which Nissan Leaf models are affected?
The publicly described research specifically examined a 2020 Nissan Leaf ZE1 with a Bosch-manufactured infotainment ECU and firmware version 283C30861E. The advisory also discusses older firmware versions for particular weaknesses, but the available evidence does not establish that every CVE affects every Leaf year, market, trim, ECU supplier, or firmware release.
What should a Nissan Leaf owner do now?
First identify the exact model year, market, infotainment hardware, and software version. Then check official Nissan owner guidance or ask an authorized dealer whether a relevant software update, campaign, or technical instruction applies. Do not attempt exploit reproduction, unofficial firmware flashing, anti-theft bypasses, or direct CAN experimentation.
The Bottom Line
Bottom line: PCAutomotive’s 2025 research showed a serious, multi-stage compromise in a tested 2020 Nissan Leaf ZE1 configuration, including reported privacy exposure and control of several physical vehicle functions in a controlled demonstration. It did not prove that every Leaf can be remotely driven, that the 2016 NissanConnect flaw enabled steering, or that the research was being used against ordinary drivers. Owners should verify their exact hardware and firmware with Nissan rather than rely on the model name, a generic gadget, or an app shutdown.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
