SinoTrack GPS device flaws allow remote vehicle control and location tracking
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-5484 | A username and password are required to authenticate to the central SinoTrack device management interface. A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification of the default password is not enforced during device setup. A malicious actor can retrieve device identifiers with either physical access or by capturing identifiers from pictures of the devices posted on publicly accessible websites such as eBay. NVD description · AI analysis pending | 7.6 | <1% | — | — | ||
| CVE-2025-5485 | User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malicious actor can enumerate potential targets by incrementing or decrementing from known identifiers or through enumerating random digit sequences. NVD description · AI analysis pending | 8.8 | <1% | — | — |
Full article339 words · extracted from securityaffairs.com · click to collapse
Two vulnerabilities in SinoTrack GPS devices can allow remote vehicle control and location tracking by attackers, US CISA warns.
U.S. CISA warns of two vulnerabilities in SinoTrack GPS devices that remote attackers can exploit to access a vehicle’s device profile without permission. The researchers warn that potential exploitation could allow attackers to track its location or even cut power to the fuel pump, depending on the model.
“Successful exploitation of these vulnerabilities could allow an attacker to access device profiles without authorization through the common web management interface.” reads the advisory published by CISA. “Access to the device profile may allow an attacker to perform some remote functions on connected vehicles such as tracking the vehicle location and disconnecting power to the fuel pump where supported.”
Below is a brief description of the vulnerabilities:
- CVE-2025-5484 (CVSS score: 8.3) – SinoTrack devices use a default password that’s the same for all units, and changing it isn’t required during setup. Since the username is just the device ID printed on the label, someone could easily gain access by either physically seeing the device or spotting it in online photos, like on eBay. This makes it surprisingly easy for attackers to break in.
- CVE-2025-5485 (CVSS score: 8.6) – SinoTrack devices use a default password that’s the same for all units, and changing it isn’t required during setup. Since the username is just the device ID printed on the label, someone could easily gain access by either physically seeing the device or spotting it in online photos, like on eBay. This makes it surprisingly easy for attackers to break in.
CISA urges users to change default passwords, hide device IDs, and assess risks before taking action. Since SinoTrack didn’t respond to CISA, users should check with the vendor directly. CISA also recommends following cybersecurity best practices, avoiding phishing links, and reporting any suspicious activity. No known public exploitation of the vulnerabilities has been reported so far.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, SinoTrack GPS)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/178922/security/sinotrack-gps-device-flaws-allow-remote-vehicle-control-and-location-tracking.html