关键词: 新能源商用车；网络安全；TARA；渗透测试；漏洞防护

Abstract: In view of the cybersecurity risks exposed during the intelligent evolution of new energy commercial vehicles, taking a certain model as the object, this paper integrates threat analysis and risk assessment (TARA) with penetration testing to identify key vulnerabilities and propose protective solutions. Focusing on core assets like the central gateway, TARA analysis is conducted to identify high-risk threat scenarios. Based on the results, an information security test bench for the vehicle's electrical system is built, and gray-box penetration testing is used to simulate attack paths and verify vulnerabilities. It is found that an unprotected on-board diagnostics (OBD) interface could lead to unauthorized vehicle control, and gateway routing without validation could trigger cross-subnet attacks. Through physical protection, authentication authorization, firewalls, and other fixes, risk levels are significantly reduced. The article provides empirical cases for the cybersecurity development of commercial vehicles, assisting enterprises in meeting the requirements of the vehicle cybersecurity technical specifications (GB 44495－2024) standard and UN Regulation (R155), and promoting the optimization of security design.

Key words: new energy commercial vehicles; cybersecurity; TARA; penetration testing; vulnerability protection