1. EXECUTIVE SUMMARY
- CVSS v4 8.8
- ATTENTION: Exploitable remotely/Low attack complexity
- Vendor: SinoTrack
- Equipment: All Known SinoTrack Devices
- Vulnerabilities: Weak Authentication, Observable Response Discrepency
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to access device profiles without authorization through the common web management interface. Access to the device profile may allow an attacker to perform some remote functions on connected vehicles such as tracking the vehicle location and disconnecting power to the fuel pump where supported.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following SinoTrack products are affected:
- SinoTrack IOT PC Platform: All versions
3.2 VULNERABILITY OVERVIEW
3.2.1 WEAK AUTHENTICATION CWE-1390
A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification of the default password is not enforced during device setup. A malicious actor can retrieve device identifiers with either physical access or by capturing identifiers from pictures of the devices posted on publicly accessible websites such as eBay.
CVE-2025-5484 has been assigned to this vulnerability. A CVSS v3 base score of 8.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L).
A CVSS v4 score has also been calculated for CVE-2025-5484. A base score of 7.6 has been calculated; the CVSS vector string is (This article has been indexed from All CISA Advisories