The Ministry of Heavy Industries (MHI) has directed automobile manufacturers to immediately audit battery communication systems, eliminate cybersecurity vulnerabilities and accelerate preparations for upcoming vehicle cybersecurity regulations after reports of a security flaw that could allow unauthorised users to remotely disable moving electric vehicles.
In an advisory issued to the Society of Indian Automobile Manufacturers (SIAM) and vehicle testing agencies, the ministry asked original equipment manufacturers (OEMs) to review battery communication interfaces, eliminate insecure default settings, strengthen authentication mechanisms and secure over-the-air (OTA) communication pathways.
The ministry has also called for closer coordination among the Ministry of Road Transport and Highways (MoRTH), the Ministry of Electronics and Information Technology (MeitY), automobile manufacturers and other stakeholders to incorporate cybersecurity safeguards into vehicle design.
Significantly, the advisory asks manufacturers to begin preparing for the rollout of AIS-189 and AIS-190, the proposed vehicle cybersecurity regulations that introduce mandatory Cyber Security Management Systems (CSMS) and Software Update Management Systems (SUMS). The draft notification proposes a phased implementation beginning October 1, 2026, requiring manufacturers to secure OTA software updates, strengthen user authentication and validate software integrity.
The advisory follows reports that surfaced on July 1-2 claiming that a smartphone application called BAT-BMS was used to unexpectedly shut down moving e-rickshaws by disconnecting the battery’s discharge function.
According to the ministry, the application, developed by Shenzhen Grenergy Technology, is a legitimate tool for managing Bluetooth-enabled battery systems. However, a critical security vulnerability arises when low-cost lithium battery packs are deployed with factory-default settings, weak passwords or without Bluetooth authentication.
Under such conditions, the ministry said, anyone standing within a range of around 10-15 metres can connect to the battery using the application and switch off the “Discharge” function, instantly cutting power to the motor and bringing the vehicle to a halt.
While MeitY has already initiated action to remove applications such as BAT-BMS, Epoch Li-ion, SMART BMS and Lossigy from app stores, the ministry said removing the apps addresses only the immediate symptom, while the underlying vulnerability in battery communication interfaces remains.
The advisory noted that although the latest battery safety standards under AIS-156 and AIS-038 Rev.2 have integrated telematics and connected features into modern battery systems, they neither mandate specific wireless communication technologies nor guarantee complete protection against cyber threats.
The ministry said no single standard could eliminate every digital risk, but implementation of AIS-189 and AIS-190 would be a decisive step towards building a trustworthy connected vehicle ecosystem in India.
The ministry has also requested SIAM and the Automotive Component Manufacturers Association (ACMA) to circulate the advisory among vehicle and component manufacturers and ensure cybersecurity protocols are prioritised. Stakeholders have also been asked to immediately report any further vulnerabilities to the ministry.