# CVE-2025-5484

## Summary

- **CVE ID:** CVE-2025-5484
- **Severity:** HIGH
- **CVSS Score:** 8.3 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N)
- **CWE:** CWE-1390
- **Published:** Jun 12, 2025
- **Last Modified:** Mar 13, 2026

## Description

A username and password are required to authenticate to the central 
SinoTrack device management interface. The username for all devices is 
an identifier printed on the receiver. The default password is 
well-known and common to all devices. Modification of the default 
password is not enforced during device setup. A malicious actor can 
retrieve device identifiers with either physical access or by capturing 
identifiers from pictures of the devices posted on publicly accessible 
websites such as eBay.

## Affected Products

- SinoTrack — IOT PC Platform (All versions)

## References

- [CNA](https://www.cisa.gov/news-events/ics-advisories/icsa-25-160-01)
- [CNA](https://www.sinotrackgps.com/help-center)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.43%
- **EPSS Percentile:** 36.3

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._