App users are exploiting weak access controls in the BMS for unauthorised access to features that affect the EV's operations ...