Archive first published
Mitsubishi Outlander PHEV Hack: How the 2016 Wi-Fi Flaw Worked
In June 2016 the British security firm Pen Test Partners showed that the Mitsubishi Outlander PHEV could be controlled over its own Wi-Fi network. After cracking the weak network key, the researchers could switch off the alarm, flash the lights, change the charging schedule and run the climate control to drain the battery. They could not drive the car away, but the alarm flaw worried owners.
Key takeaways
- Found by Pen Test Partners and made public in early June 2016.
- The phone app talked to the car through a Wi-Fi access point in the vehicle, protected by a short key.
- The key was cracked in under four days; the alarm, lights, charging and heating could then be controlled.
- Mitsubishi's remedy was to unpair all phones, which put the car's Wi-Fi module to sleep.
How the Outlander PHEV hack worked
Most connected-car apps reach the vehicle through a server and the mobile network. The first-generation Outlander PHEV instead created its own Wi-Fi access point, and the owner's phone had to be within range of it. The network key was printed in the owner's paperwork and was short and simple. The researchers cracked it by brute force in under four days.
Size at a glance
Toyota RAV4 XA50
The Mitsubishi Outlander GN is 109 mm longer, 42 mm wider and 60 mm taller than the Toyota RAV4 XA50.
| Dimensions | Mitsubishi Outlander GN | Toyota RAV4 XA50 | Difference |
|---|---|---|---|
| Length | 4,709 mm185.4 in | 4,600 mm181.1 in | +109 mm+4.3 in |
| Width | 1,897 mm74.7 in | 1,855 mm73.0 in | +42 mm+1.7 in |
| Height | 1,745 mm68.7 in | 1,685 mm66.3 in | +60 mm+2.4 in |
| Wheelbase | 2,705 mm106.5 in | 2,690 mm105.9 in | +15 mm+0.6 in |
| Boot | - | 580 L20.5 cu ft | - |
Honda CR-V VI
The Mitsubishi Outlander GN is 15 mm longer, 31 mm wider and 63 mm taller than the Honda CR-V VI.
| Dimensions | Mitsubishi Outlander GN | Honda CR-V VI | Difference |
|---|---|---|---|
| Length | 4,709 mm185.4 in | 4,694 mm184.8 in | +15 mm+0.6 in |
| Width | 1,897 mm74.7 in | 1,866 mm73.5 in | +31 mm+1.2 in |
| Height | 1,745 mm68.7 in | 1,682 mm66.2 in | +63 mm+2.5 in |
| Wheelbase | 2,705 mm106.5 in | 2,700 mm106.3 in | +5 mm+0.2 in |
| Boot | - | 617 L21.8 cu ft | - |
Mitsubishi Outlander GF
The Mitsubishi Outlander GN is 54 mm longer, 97 mm wider and 65 mm taller than the Mitsubishi Outlander GF.
| Dimensions | Mitsubishi Outlander GN | Mitsubishi Outlander GF | Difference |
|---|---|---|---|
| Length | 4,709 mm185.4 in | 4,655 mm183.3 in | +54 mm+2.1 in |
| Width | 1,897 mm74.7 in | 1,800 mm70.9 in | +97 mm+3.8 in |
| Height | 1,745 mm68.7 in | 1,680 mm66.1 in | +65 mm+2.6 in |
| Wheelbase | 2,705 mm106.5 in | 2,670 mm105.1 in | +35 mm+1.4 in |
| Boot | - | 591 L20.9 cu ft | - |
Sitting between the app and the car, the team recorded its messages, decoded the protocol and sent commands of its own.
What attackers could and could not do
| Function | Possible after the hack? |
|---|---|
| Switch the alarm off | Yes |
| Turn the lights on and off | Yes |
| Change the charging schedule | Yes, e.g. to charge at peak tariff |
| Run heating or air conditioning | Yes, draining the battery |
| Start and drive the car | No, the remote key was still needed |
The alarm was the serious part. With it switched off, a thief who opened the car by other means would not set it off. The old 1cars report added that the battery was drained during the tests.
How many cars were affected
More than 100,000 Outlander PHEVs had been sold worldwide by mid-2016, about 22,000 of them in the UK. It went on sale in Japan in January 2013 and in Europe in October 2013, with a 2.0 petrol engine, two 60 kW electric motors and a 12 kWh battery. It was Europe's best-selling plug-in hybrid from 2013 to 2017. By our calculation, roughly one in five cars sold by 2016 was in the UK.
Mitsubishi's response and fix
Mitsubishi UK at first reportedly saw no serious problem, then said it took the matter seriously and that only app functions were affected. Its advice was to use the app's "Cancel VIN Registration" option to unpair every phone. With no paired devices, the Wi-Fi module goes to sleep and wakes only after the key fob is pressed ten times. The catch was that the app then stopped working. The researchers urged a firmware update and a redesigned connection.
What changed for connected cars
The second-generation Outlander PHEV, released in Japan in October 2021, pairs a 2.4 engine with 125 kW (170 PS) and a 20 kWh battery for up to 87 km of electric range. Compared with the first car's 12 kWh, that battery is 67 % larger. It reached some European countries in early 2025. Since July 2024 the EU has required every newly registered car to meet UN Regulation No. 155 on cyber security, adopted in 2020. More about the model is on the Mitsubishi Outlander page and in the history of Mitsubishi.
Should you buy a used first-generation PHEV?
It suits drivers who charge at home and mostly cover short trips. Unpair all old phones, check the battery's remaining capacity and leave the Wi-Fi module asleep if you do not use the app. To weigh it against a rival, use the Kia Sportage vs Mitsubishi Outlander comparison. The section on electric cars and the guide to hybrid cars explain the technology, and the Mitsubishi catalogue lists the range.
FAQ
Can a Mitsubishi Outlander PHEV be hacked?
In 2016 researchers showed that first-generation cars could be controlled over the car's Wi-Fi once its short network key was cracked. They could disable the alarm and control lights, charging and climate, but not drive the car.
How do I turn off the Wi-Fi on my Outlander PHEV?
Mitsubishi's advice was to unpair every phone using the app's "Cancel VIN Registration" option. The Wi-Fi module then sleeps until the key fob is pressed ten times, although the app no longer works.
Could thieves steal an Outlander PHEV through the hack?
Not directly, because the car could not be started without the remote key. However, a switched-off alarm would make a conventional break-in less likely to be noticed by anyone nearby.
Who discovered the Outlander PHEV vulnerability?
The British firm Pen Test Partners found it while studying how the owner app connected to the car, and went public in early June 2016 after first contacting Mitsubishi in the UK.
