BYD identifies Shark 6 infotainment defect, but OTA fix has no date
BYD says its engineers have reproduced a software defect in the Shark 6 infotainment system and that the company is developing an over-the-air update. The finding follows an authorised security demonstration that reached location and microphone functions after researchers physically prepared the vehicle.
In a statement reported by CarExpert and TorqueCafe on 1 October, the carmaker said its engineers reproduced an unintended pathway that enabled Android Debug Bridge, or ADB, and allowed an untrusted application to be installed. As of 1 October, BYD had not published a fixed software version or release date, and no patch was available.
The finding answers one of the central questions left by the demonstration broadcast by ABC Four Corners on 21 September. It does not establish that an untouched Shark 6 can be compromised remotely without prior access. Nor does it mean that every Shark 6, or another BYD model, has been confirmed to contain the defect.
Remote control followed physical preparation
Fortify Labs, which conducted the research for the ABC programme, later identified the tested vehicle as a 2025 BYD Shark 6 Premium running head-unit software version 56.1.2.2507080.1. The company said the vehicle had been reported fully patched on 16 July, the day before its research began.
According to Fortify Labs, researchers needed physical access to install software on the head unit. They could then control that software remotely through their own cellular hotspot. The vehicle’s BYD telematics SIM had been removed, and the researchers said they did not use BYD’s back-end infrastructure.
On the published evidence, the demonstrated path was remote control after local preparation, rather than a spontaneous internet attack against an untouched vehicle. Fortify Labs has withheld the initial access procedure, so the full set of prerequisites cannot be independently reconstructed from its public account.
The physical-access requirement does not remove the security concern. BYD has acknowledged a software defect that allowed an application to be installed. Fortify Labs said the prepared application could subsequently reach privacy-sensitive functions remotely. BYD said requests for location or microphone access produced an infotainment permission prompt and required manual approval. The public accounts do not establish who approved those prompts or at what stage of the test.
Fortify Labs said it neither modified the vehicle’s firmware nor escalated privileges. It also reported that SELinux policies and separation provided by QNX prevented access to cameras and more sensitive components during the assessment. Those boundaries make descriptions of an unrestricted or complete vehicle takeover inconsistent with the published evidence.
Lights and wipers used a separate route
The operation of the Shark 6’s headlights and wipers came from a second technical chain. Fortify Labs said it directly tapped the vehicle’s CAN-bus wiring and connected a Raspberry Pi that simulated a compromised electronic control unit.
That setup must be distinguished from the infotainment application and its remote connection. It did not demonstrate that the lights and wipers were reached through BYD’s normal remote services, cloud systems or factory telematics connection.
BYD said it had opened a separate assessment of CAN-bus risks, including the authenticity, integrity and freshness of messages. Any additional technical measures will depend on that work. The promised infotainment update therefore addresses the identified ADB-enablement pathway, not a completed fix for the physically prepared CAN-bus demonstration.
Patch scope remains unclear
BYD said software remediation had started and that a future update for Shark 6 vehicles would be deployed after validation. It was also assessing whether other Australian BYD models required the update. No complete list of affected model years, configurations or software builds has been published, and other models should not be treated as affected while that assessment remains open.
The only configuration publicly tied to a specific build is the 2025 Shark 6 Premium tested by Fortify Labs. BYD’s broader reference to an update for Shark 6 vehicles may eventually clarify the scope, but it does not yet show how many vehicles contain the defect or whether deployment will vary by software version.
The published accounts contain no evidence of malicious exploitation against owners. The research was commissioned for Four Corners and conducted on a vehicle owned by Fortify Labs. No malicious actor, owner service outage, BYD back-end intrusion or data exfiltration was reported.
No vulnerability-specific temporary workaround has been announced. Fortify Labs advises owners to keep vehicle and companion-app software current and install updates when offered, but that is general security hygiene rather than a temporary fix for this defect.
The practical next step is BYD’s promised update, although owners still lack a date or identifier with which to recognise it. The remaining questions include which builds will receive it, whether previously installed applications will be detected or removed, whether other models share the pathway, and whether BYD will issue a formal security advisory or vulnerability identifier.
Authorised security demonstrations are easier to assess when local prerequisites and later remote control are treated as separate stages. Use The Hack Academy's online cybersecurity training programme to study networking and internet vulnerabilities at your own pace through theory and practical exercises.
