{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"cveMetadata": {
"cveId": "CVE-2025-5484",
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"state": "PUBLISHED",
"assignerShortName": "icscert",
"dateReserved": "2025-06-02T20:33:01.305Z",
"datePublished": "2025-06-12T20:03:32.255Z",
"dateUpdated": "2025-06-12T20:16:45.707Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IOT PC Platform",
"vendor": "SinoTrack",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Raúl Ignacio Cruz Jiménez reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A username and password are required to authenticate to the central \nSinoTrack device management interface. The username for all devices is \nan identifier printed on the receiver. The default password is \nwell-known and common to all devices. Modification of the default \npassword is not enforced during device setup. A malicious actor can \nretrieve device identifiers with either physical access or by capturing \nidentifiers from pictures of the devices posted on publicly accessible \nwebsites such as eBay."
}
],
"value": "A username and password are required to authenticate to the central \nSinoTrack device management interface. The username for all devices is \nan identifier printed on the receiver. The default password is \nwell-known and common to all devices. Modification of the default \npassword is not enforced during device setup. A malicious actor can \nretrieve device identifiers with either physical access or by capturing \nidentifiers from pictures of the devices posted on publicly accessible \nwebsites such as eBay."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert",
"dateUpdated": "2025-06-12T20:06:27.184Z"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-160-01"
},
{
"url": "https://www.sinotrackgps.com/help-center"
}
],
"source": {
"advisory": "ICSA-25-160-01",
"discovery": "EXTERNAL"
},
"title": "SinoTrack GPS Receiver Weak Authentication",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "SinoTrack did not respond to CISA's request for coordination. Please contact SinoTrack for more information.\n\n
"
}
],
"value": "SinoTrack did not respond to CISA's request for coordination. Please contact SinoTrack https://www.sinotrackgps.com/help-center for more information."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2025-06-12T20:16:35.788506Z",
"id": "CVE-2025-5484",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2025-06-12T20:16:45.707Z"
}
}
]
}
}