Skip to content
OpenAdvisories
High ICSA-25-160-01 2 CVEs

SinoTrack GPS Receiver

Published Jun 10, 2025 · Updated Jun 10, 2025

Vendor: SinoTrack Product: IOT PC Platform

Summary

Successful exploitation of these vulnerabilities could allow an attacker to access device profiles for which they are not authorized through the common web management interface. Access to the device profile may allow an attacker to perform some remote functions on connected vehicles such as tracking the vehicle location and disconnecting power to the fuel pump where supported.

Vulnerabilities 2

  • High 8.6
    CVE-2025-5485

    SinoTrack GPS Receiver Weak Authentication

    User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malicious actor can enumerate potential targets by incrementing or decrementing from known identifiers or th…

    SinoTrack IOT PC Platform
  • High 8.3
    CVE-2025-5484

    SinoTrack GPS Receiver Weak Authentication

    A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification of the…

    SinoTrack IOT PC Platform

Revision history

  1. #1

    Initial Publication

References