Description

A username and password are required to authenticate to the central
SinoTrack device management interface. The username for all devices is
an identifier printed on the receiver. The default password is
well-known and common to all devices. Modification of the default
password is not enforced during device setup. A malicious actor can
retrieve device identifiers with either physical access or by capturing
identifiers from pictures of the devices posted on publicly accessible
websites such as eBay.

Classification

CVE ID: CVE-2025-5484

CVSS Base Severity: HIGH

CVSS Base Score: 8.3

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Affected Products

Vendor: SinoTrack

Product: IOT PC Platform

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 11.59% (scored less or equal to compared to others)

EPSS Date: 2025-06-21 (when was this score calculated)

Stakeholder-Specific Vulnerability Categorization (SSVC)

SSVC Exploitation: none

SSVC Technical Impact: partial

SSVC Automatable: false

References

https://nvd.nist.gov/vuln/detail/CVE-2025-5484
https://www.cisa.gov/news-events/ics-advisories/icsa-25-160-01
https://www.sinotrackgps.com/help-center

Timeline