Vehicle SOC — SBOM, VEX, RXSWIN Tracking

Monitored Fleet

Vehicles connected to backend

Critical Vulnerabilities

0 critical · 2 high in triage (OTA staged)

Telematics Anomalies

IDS Intrusion Detection Alerts (24h)

SBOM Dependencies

Open-source & 3rd-party packages

SBOM Dependency Explorer

CycloneDX Format

🖥️ Zynq-7000 Firmware v4.2.1-rc3

⚙️ PetaLinux OS 2023.1

📦 OpenSSL 3.0.8 CVSS 7.5

📦 busybox 1.36.0

🌐 FreeRTOS IP Stack v10.4

📦 lwIP 2.1.2 CVSS 7.5

🧠 MotorCtrl_Alg Proprietary

Global Threat Intelligence Feed

LIVE SYNC

10:42:05 UTC NVD Database Match

CVE-2023-0464 (OpenSSL 3.0.8 · CVSS 7.5)

X.509 policy-constraint resource exhaustion. SBOM cross-reference: match in Zone 3 IVI (PetaLinux 2023.1). Patch to 3.0.9+ staged as OTA v4.2.2.

10:38:12 UTC Fleet IDS Telemetry

Anomalous UDS Auth Attempts

Vehicle VIN ending in 8F2A reported 15 failed UDS Seed/Key authentications on OBD-II interface. IP flagged.

10:15:00 UTC Auto-ISAC Intel

New CAN Injection Pattern (EU Region)

Advisory regarding a novel CAN FD injection technique targeting unencrypted powertrain buses. (Not applicable to our fleet: SecOC active).

Incident Response & Mitigation Workflow

Vulnerability Management

CVE / Incident ID	CVSS Score	Affected Component	Impacted Zone	Mitigation Status	Action

Attack Scenario Replay — T-02 CAN Injection

Compromised IVI emits forged torque frame (ID 0x3A2)

SecOC MAC verification fails at gateway — frame dropped

IDPS flags CAN anomaly burst · score 0.94

V-SOC incident INC-2026-0610 opened · fleet query: 1 vehicle

TARA loopback: T-02 control effective — risk value unchanged

Evidence archived per UN R155 §7.2.2.4

— defense-in-depth chain idle —

Software Update Management — UN R156 / ISO 24089

RXSWIN Registry

RXSWIN	SW Version	Affected ECUs	Type Approval Impact	Campaign Status

RXSWIN integrity verified at each OTA campaign per UN R156 §7.1; update engineering process aligned with ISO 24089. Anti-rollback enforced by HSM monotonic counter before activation.

Load your own SBOM

SPDX 2.x / CycloneDX 1.x · in-browser

Drop an SPDX or CycloneDX document and the component inventory is rebuilt from it, together with any vulnerability records the file carries. The file is parsed in this browser and is never uploaded — an SBOM names every third-party component in a shipping ECU.