SinoTrack GPS vulnerabilities may allow attackers to track, control vehicles
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-5484 | A username and password are required to authenticate to the central SinoTrack device management interface. A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification of the default password is not enforced during device setup. A malicious actor can retrieve device identifiers with either physical access or by capturing identifiers from pictures of the devices posted on publicly accessible websites such as eBay. NVD description · AI analysis pending | 7.6 | <1% | — | — | ||
| CVE-2025-5485 | User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malicious actor can enumerate potential targets by incrementing or decrementing from known identifiers or through enumerating random digit sequences. NVD description · AI analysis pending | 8.8 | <1% | — | — |
Full article416 words · extracted from helpnetsecurity.com · click to collapse
Vulnerabilities affecting the SinoTrack GPS tracking platform may allow attackers to keep tabs on vehicles’ location and even perform actions such as disconnecting power to vehicles’ fuel pump (if the tracker can interact with a car’s system).
The warning was issued by the Cybersecurity and Infrastructure Security Agency (CISA) last week, based on a report by security researcher Raúl Ignacio Cruz Jiménez, and the vulnerabilities have yet to be patched.
The vulnerabilities (CVE-2025-5484, CVE-2025-5485)
SinoTrack is a China-based manufacturer specializing in GPS tracking devices and fleet management solutions. According to the company, over 6 million of its GPS trackers are installed in vehicles around the world.
The vulnerabilities (CVE-2025-5484, CVE-2025-5485) flagged by the researcher affect all versions of the SinoTrack IOT PC platform, which connects the GPS trackers to a web/app management interface that provides dashboards, alerts, and – depending on the tracker model – enables remote control of certain functions.
SinoTrack GPS trackers are authenticated to the platform by using the device’s unique ID – a numerical identifier consisting of up to 10 digits – and a password.
But while the username for all devices might be unique, it’s also printed on the tracker, which means that attackers can discover it if they have physical access to a device or can glean it from publicly available pictures of devices (e.g., from Ebay listings).
Attackers can also “enumerate potential targets by incrementing or decrementing from known identifiers or through enumerating random digit sequences,” CISA explained.
Add to this the fact that users are not required to change the publicly known default password when setting up the tracker, and the potential for exploitation becomes obvious.
What to do?
“SinoTrack did not respond to CISA’s request for coordination,” the agency confirmed, and urged users of the company’s trackers to change the default password to a unique, complex one as soon as possible and to hide the device identifier.
“If the sticker is visible on publicly accessible photographs, consider deleting or replacing the pictures to protect the identifier,” they added.
We’ve asked SinoTrack whether they intend to implement mitigations to close this avenue for attack, and we’ll update this article when we hear back from them.
In 2022, BitSight researchers notified China-based manufacturer MiCODUS of vulnerabilities in a specific GPS tracker model that might have allowed similar attacks, and the company pushed out fixes.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/06/16/sinotrack-gps-vulnerabilities-may-allow-attackers-to-track-control-vehicles/