CVE-2025-11690

An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users’ vehicles. Exploiting this issue enables an attacker to retrieve data such as GPS coordinates, encryption keys, initialization vectors, model numbers, and fuel statistics belonging to other users, instead of being limited to their own vehicle data. The fix for this vulnerability is a server-side authorization fix.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://advisories.ncsc.nl/2025/ncsc-2025-0350.html
https://medium.com/@ilnur.khakimov_86612/how-i-hacked-100-000-motorcycles-including-my-own-666bdb702b7d

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de Referencia Directa a Objeto Insegura (IDOR) existe en el parámetro 'vehicleId', permitiendo acceso no autorizado a información sensible de vehículos de otros usuarios. La explotación de este problema permite a un atacante recuperar datos como coordenadas GPS, claves de cifrado, vectores de inicialización, números de modelo y estadísticas de combustible pertenecientes a otros usuarios, en lugar de estar limitado a los datos de su propio vehículo. La solución para esta vulnerabilidad es una corrección de autorización del lado del servidor.

Information

Published : 2025-11-04 11:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-11690

Mitre link : CVE-2025-11690

CVE.ORG link : CVE-2025-11690

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-11690", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11690", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-04T20:19:43.802129Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cert@ncsc.nl", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "cert@ncsc.nl", "affectedData": [{"vendor": "CFMOTO", "product": "RIDE", "versions": [{"status": "affected", "version": "1", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-04T11:15:37.573", "references": [{"url": "https://advisories.ncsc.nl/2025/ncsc-2025-0350.html", "source": "cert@ncsc.nl"}, {"url": "https://medium.com/@ilnur.khakimov_86612/how-i-hacked-100-000-motorcycles-including-my-own-666bdb702b7d", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cert@ncsc.nl", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users\u2019 vehicles. Exploiting this issue enables an attacker to retrieve data such as GPS coordinates, encryption keys, initialization vectors, model numbers, and fuel statistics belonging to other users, instead of being limited to their own vehicle data. The fix for this vulnerability is a server-side authorization fix."}, {"lang": "es", "value": "Una vulnerabilidad de Referencia Directa a Objeto Insegura (IDOR) existe en el par\u00e1metro 'vehicleId', permitiendo acceso no autorizado a informaci\u00f3n sensible de veh\u00edculos de otros usuarios. La explotaci\u00f3n de este problema permite a un atacante recuperar datos como coordenadas GPS, claves de cifrado, vectores de inicializaci\u00f3n, n\u00fameros de modelo y estad\u00edsticas de combustible pertenecientes a otros usuarios, en lugar de estar limitado a los datos de su propio veh\u00edculo. La soluci\u00f3n para esta vulnerabilidad es una correcci\u00f3n de autorizaci\u00f3n del lado del servidor."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "cert@ncsc.nl"}