A new PowerDrop virus is aimed at the American aerospace industry.

Due to API weaknesses that allow password reset for any account, Honda’s e-commerce platform for power equipment, marine, and lawn & garden was open to unauthorized access by anybody.

Honda is a Japanese company that produces cars, motorbikes, and power tools. Owners of Honda vehicles or motorbikes are not harmed in this scenario because only the latter division is touched.

Eaton Zveare, a security researcher who previously used similar flaws to get into Toyota’s supplier site, found the security hole in Honda’s systems.

For Honda, Eaton Works took advantage of a password reset API to get unfettered admin-level access to the company’s network by changing the passwords of important accounts.

The information below was consequently made available to the security researcher and perhaps threat actors using the same vulnerability: From August 2016 to March 2023, there were 21,393 client orders across all dealers. This figure contains the consumer’s name, address, phone number, and the things they ordered, 1,091 of the 1,570 dealer websites are operational. Any of these sites might have been altered, 3,588 dealer users or accounts (first and last names and email addresses included). Any one of these users might alter their password, 1,090 dealer emails (first and last name included), 11,034 emails from customers (first and last names included), and, Reports on internal finances.