Yutong electric buses in Oslo found with remote control security flaw
Oslo's public transport operator Ruter discovered that electric buses manufactured by Chinese company Yutong contain a SIM card enabling remote software installation, creating a potential security vulnerability where the manufacturer or malicious actors could remotely control vehicles. The Norwegian government has opened an investigation to assess risks associated with using buses from countries without security cooperation agreements.
What happened
Ruter, the public transport operator in Oslo, tested two electric buses in summer 2025, one made by China's Yutong and one by the Netherlands' VDL Group.
Testing revealed that the Yutong bus contained a SIM card that allowed the manufacturer to remotely install software updates, creating a security vulnerability. The VDL bus lacked this feature.
Ruter stated that any connected system poses risk, and that not only the supplier but also external malicious actors could potentially infiltrate the supply chain and affect bus operations.
Reported impact
Ruter currently operates approximately 300 Chinese-made electric buses in Oslo and surrounding areas, but it is unclear whether these buses have the same security flaw.
The Norwegian Ministry of Transport stated it is investigating the matter and plans to fully assess risks associated with using buses from countries without security cooperation agreements with Norway.
Index analysis
The vulnerability stems from a SIM card embedded in the Yutong buses that enables remote access for software updates, distinguishing it from the comparable Dutch-manufactured alternative that lacks this capability.
Governance controls
Ruter is developing a digital firewall system to prevent such problems in the future.
The Norwegian government indicated it will conduct a comprehensive risk assessment regarding buses from countries without established security cooperation with Norway.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.