Lexus recalls 7,015 IS sedans and convertibles to replace Takata inflators again

Lexus is recalling 7,015 examples of its second-generation IS sedan and convertible in Australia to replace front passenger airbag inflators fitted under an earlier Takata recall. The voluntary safety campaign covers vehicles produced between August 31, 2005 and December 25, 2012, spanning the IS250, IS250C, IS350 and IS F nameplates.

Why the inflators are being replaced again

The recall notice states the affected cars carry certain Takata front passenger airbag inflators installed as replacement parts under a prior recall, which contain a desiccated, phase-stabilised ammonium nitrate (PSAN) propellant. Lexus Australia says continued prolonged exposure to high absolute humidity, high temperatures and high temperature cycling may cause the inflator to rupture during airbag deployment because the propellant can degrade.

A rupture can send metal fragments through the airbag and into the cabin at high speed, which may cause injury or death to occupants. Lexus describes the recall as a proactive measure and says investigation of recovered parts has not currently identified any propellant degradation. No issues have been reported, and the company says customers can keep driving their vehicles.

The recall is limited to the front passenger airbag in these IS models and does not affect any other airbags or other Lexus model lines. That narrow scope matters for owners: the fix is a single inflator, not a wider airbag system inspection, so the practical burden on drivers is a workshop visit rather than a broader safety review.

What owners need to do

Affected owners should book an appointment with an authorised dealer to have the inflator replaced free of charge. Lexus estimates the work at about 4.5 hours per vehicle, though it advises that depending on the dealer's schedule the car may need to be made available for longer.

Owners with questions can contact their preferred Lexus dealer or the Lexus Customer Assistance Centre on 1800 023 009 on weekdays between 9:30am and 5:30pm. The original recall notice and Vehicle Identification Number (VIN) list are attached to the recall documentation.

The sources do not state how many of the 7,015 affected cars have already had a replacement inflator fitted, so that figure has not been announced. Owners who are unsure whether their car is caught should check the VIN list rather than assume a previous recall visit has closed the matter.

A long history of Takata recalls for the IS

This is not the first Takata-related campaign for the IS in Australia. In June 2016, Lexus Australia recalled 21,750 IS sedan and convertible variants built between 2005 and 2011 because the front passenger airbag inflator could become susceptible to moisture intrusion over time, making the assembly prone to rupture. A further 2,166 IS models were added in January 2017.

The pattern here is a recall of a recall part. Because the inflators now being replaced were themselves fitted as remedies under earlier campaigns, the latest notice shows that a repaired car is not automatically a closed case. For buyers of used second-generation IS models, checking the VIN against the current list is the reliable way to confirm the work has been done.

Security researchers found administrator credentials for an unnamed carmaker's connected vehicle platform exposed in a vendor file bundled with its smartphone app, allowing them to remotely unlock cars, start and stop engines, reset passwords and bypass multi-factor authentication. The automaker has since fixed the flaw, but it never named itself publicly.

How the credentials leaked

Shubham Shah and Sam Curry discovered that the car company had exposed administrator credentials for the identity management system behind its connected vehicle app, according to iTnews. The credentials belonged to the ForgeRock OpenIDM system, which manages every account on the undisclosed company's connected vehicle platform, and were embedded in a vendor JavaScript file that the app uses to carry out tasks and talk to online systems.

Because that file shipped with the Android app, everyone who downloaded it received the administrator credentials along with it. Shah is co-founder of the Australian security firm Assetnote.

The researchers started from a single number plate and worked their way into the affected automaker's connected vehicle systems from there. Connected cars, meaning vehicles linked to the internet, now take in most new models on sale, and brands offering connected vehicle apps in Australia include Toyota, Ford, Hyundai, GWM, BMW and Tesla.

What the researchers could do

Once inside, the pair could remotely unlock vehicles and start and stop their engines wherever those functions were enabled. They could also reset user passwords and get around multi-factor authentication for the app.

The access reached personal details including phone numbers and full names, plus further data such as the vehicle identification number. Shah told iTnews that other methods of unlocking these cars surely exist, but the route the researchers used was fully remote and would affect any customer who had the relevant functionality switched on.

The carmaker's Australian systems proved easier to get into than its North American ones, with the local web application firewall offering weaker protection. The report described the manufacturer as one that sells two brands in Australia, a detail that narrows the field without settling it.

The obvious question, which carmaker was it, has no public answer: the company was not named in the report. That matters because owners of any connected car have no easy way of knowing whether this particular flaw touched their vehicle, only that it has been closed.

Why connected car security is under scrutiny

The disclosure lands amid wider calls for more transparency over how owner data is used, stored and managed. In-car system vulnerabilities drew attention earlier this year on the ABC current affairs program Four Corners, when cybersecurity professionals got into a BYD Shark 6 ute and recorded phone calls made through the vehicle, among other things.

For buyers, the practical lesson is that a connected car's security is only as good as the app and the identity systems behind it, and those sit with the manufacturer rather than the driver. The fix here came after the credentials had already been sitting in every downloaded Android app, which suggests the exposure lasted until the researchers raised it.