CVE-2025-51643

Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper protection. An attacker with physical access to the device can use a standard SPI programmer to extract the firmware using flashrom. This results in exposure of sensitive configuration data such as APN credentials, backend server information, and network parameter

CVSS v3 2.4 LOW

2.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/NastyCrow/CVE-2025-51643	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:meitrack:t366l-g_firmware:t366l_y24h131v039:*:*:*:*:*:*:*

cpe:2.3:h:meitrack:t366l-g:-:*:*:*:*:*:*:*

History

26 Sep 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Los dispositivos de rastreo GPS Meitrack T366G-L contienen un chip de memoria flash SPI (Winbond 25Q64JVSIQ) que es accesible sin autenticación ni protección contra manipulaciones. Un atacante con acceso físico al dispositivo puede usar un programador SPI estándar para extraer el firmware usando flashrom. Esto resulta en la exposición de datos de configuración sensibles como credenciales de APN, información del servidor backend y parámetros de red.

Information

Published : 2025-08-28 16:15

Updated : 2026-09-26 00:10

NVD link : CVE-2025-51643

Mitre link : CVE-2025-51643

CVE.ORG link : CVE-2025-51643

JSON object : View

Products Affected

meitrack

t366l-g
t366l-g_firmware

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2025-51643", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-51643", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-28T20:05:42.341995Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-08-28T16:15:35.207", "references": [{"url": "https://github.com/NastyCrow/CVE-2025-51643", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper protection. An attacker with physical access to the device can use a standard SPI programmer to extract the firmware using flashrom. This results in exposure of sensitive configuration data such as APN credentials, backend server information, and network parameter"}, {"lang": "es", "value": "Los dispositivos de rastreo GPS Meitrack T366G-L contienen un chip de memoria flash SPI (Winbond 25Q64JVSIQ) que es accesible sin autenticaci\u00f3n ni protecci\u00f3n contra manipulaciones. Un atacante con acceso f\u00edsico al dispositivo puede usar un programador SPI est\u00e1ndar para extraer el firmware usando flashrom. Esto resulta en la exposici\u00f3n de datos de configuraci\u00f3n sensibles como credenciales de APN, informaci\u00f3n del servidor backend y par\u00e1metros de red."}], "lastModified": "2026-09-26T00:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:meitrack:t366l-g_firmware:t366l_y24h131v039:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "123A015E-4BE7-42F9-9B99-7519515513C7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:meitrack:t366l-g:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "91B0B724-A19E-4E03-83EB-45A04507BF85"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}