The Threat Landscape of Connected Vehicles

As connected vehicles (CVs) play an increasingly pivotal role in modern transportation, cybersecurity threats targeting these systems have become a critical area of concern. This study systematically identifies and classifies vulnerabilities from the National Vulnerability Database (NVD) and the Automotive Attack Database (AAD) using a semi-automated filtering process. Our analysis identifies a total of 508 vulnerabilities across these databases, which are categorised based on ISO/SAE 21434 impact categories: safety, financial, operational, and privacy. A key finding reveals that 14.6\% of these vulnerabilities have systemic implications, meaning they have the potential to cause widespread disruption across multiple vehicles or the broader transportation network. Furthermore, 45\% of the vulnerabilities are associated with remote attack vectors, significantly increasing the risk of large-scale exploitation. This research contributes an updated database of automotive vulnerabilities, providing a valuable resource for the cybersecurity community. The findings highlight the need to enhance current automotive cybersecurity standards, such as ISO/SAE 21434, to address the complex inter-dependencies and systemic risks within connected vehicle ecosystems.