Abstract: In view of the cybersecurity risks exposed during the intelligent evolution of new energy commercial vehicles, taking a certain model as the object, this paper integrates threat analysis and risk assessment (TARA) with penetration testing to identify key vulnerabilities and propose protective solutions. Focusing on core assets like the central gateway, TARA analysis is conducted to identify high-risk threat scenarios. Based on the results, an information security test bench for the vehicle's electrical system is built, and gray-box penetration testing is used to simulate attack paths and verify vulnerabilities. It is found that an unprotected on-board diagnostics (OBD) interface could lead to unauthorized vehicle control, and gateway routing without validation could trigger cross-subnet attacks. Through physical protection, authentication authorization, firewalls, and other fixes, risk levels are significantly reduced. The article provides empirical cases for the cybersecurity development of commercial vehicles, assisting enterprises in meeting the requirements of the vehicle cybersecurity technical specifications (GB 44495－2024) standard and UN Regulation (R155), and promoting the optimization of security design.

Key words: new energy commercial vehicles; cybersecurity; TARA; penetration testing; vulnerability protection

摘要： 针对新能源商用车智能化进程中暴露的网络安全风险，文章以某型新能源商用车为对 象，通过整合威胁分析与风险评估（TARA）、渗透测试方法，识别关键漏洞并提出防护方案。 聚焦中央网关等核心资产，开展 TARA 分析确定高风险威胁场景；基于分析结果搭建该型新 能源商用车电气系统信息安全测试台架，采用灰盒渗透测试模拟攻击路径，验证漏洞存在性。 发现车载诊断（OBD）接口未防护可导致车辆被非法控制，网关路由缺乏校验易引发跨网段 攻击；通过物理防护、认证授权及防火墙等修复措施，风险等级显著降低。文章为商用车网 络安全开发提供实证案例，助力企业满足《汽车整车信息安全技术要求》（GB 44495－2024） 标准及联合国 R155 法规要求，推动安全设计优化。

关键词: 新能源商用车；网络安全；TARA；渗透测试；漏洞防护