CVEvulnerability
CVE-2025-5484
7.6 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2025-06-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
- Weaknesses
- CWE-1390
Description
A username and password are required to authenticate to the central
SinoTrack device management interface. The username for all devices is
an identifier printed on the receiver. The default password is
well-known and common to all devices. Modification of the default
password is not enforced during device setup. A malicious actor can
retrieve device identifiers with either physical access or by capturing
identifiers from pictures of the devices posted on publicly accessible
websites such as eBay.
Related
Weakness · CWE (1)
- CWE-1390 Weak Authentication weakness
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-160-01 www.cisa.gov
- https://www.sinotrackgps.com/help-center www.sinotrackgps.com