CVE-2025-51643
2.4
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability: 0.9 / Impact: 1.4
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
Description
Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper protection. An attacker with physical access to the device can use a standard SPI programmer to extract the firmware using flashrom. This results in exposure of sensitive configuration data such as APN credentials, backend server information, and network parameter
Affected (1)
Products: Meitrack: T366l G Firmware
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version t366l_y24h131v039 |
| Running on/with | Platform Versions |
|---|---|
Meitrack T366l G | All versions |
References (1)
Timeline
No history available yet.