CVE-2019-14951

Published: Aug 12, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the authentication process, which makes it easier for attackers to obtain multimedia-screen access via port 7050 on the cellular network, as demonstrated by a DrivingRestriction method call to uma/jsonrpc/mobile.

Affected (1)

Products: Telenav: Scout Gps Link

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Telenav Scout Gps Link	From 1.0.4 to 1.0.109

Related CWEs

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (2)

https://sites.google.com/site/iosappnss/more-vulnerable-apps-and-libraries

Source: cve@mitre.org

ExploitThird Party Advisory

https://sites.google.com/site/iosappnss/more-vulnerable-apps-and-libraries

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.