What is the CVSS score of CVE-2025-63896?

CVE-2025-63896 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Jxl 9 Inch Car Android Double Din Player Firmware are affected by CVE-2025-63896?

A HIGH severity vulnerability in automotive infotainment systems (JXL 9 Inch Car Android Double Din Players) allows attackers to inject arbitrary keystrokes through spoofed Bluetooth connections,…

Is there a public PoC exploit available for CVE-2025-63896?

Yes, a public proof-of-concept exploit is available for CVE-2025-63896. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-63896?

Within 24 hours: Inventory all affected JXL 9 Inch Car Android Double Din Player units in use and identify deployment locations. Within 7 days: Implement Bluetooth pairing restrictions and disable Bluetooth HID if not operationally required; communicate risk advisory to all users and fleet managers. Within 30 days: Monitor vendor communications for security patches; evaluate replacement or hardware retrofit options if available; document all remediation steps for compliance records.

Jxl 9 Inch Car Android Double Din Player Firmware CVE-2025-63896

EUVD-2025-201273 HIGH

Missing Authentication for Critical Function (CWE-306)

2025-12-04 cve@mitre.org

Authentication Bypass Google Jxl 9 Inch Car Android Double Din Player Firmware

7.6

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.6 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201273

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

PoC Detected

Jan 22, 2026 - 15:16 vuln.today

Public exploit code

CVE Published

Dec 04, 2025 - 21:16 nvd

HIGH 7.6

DescriptionCVE.org

An issue in the Bluetooth Human Interface Device (HID) of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to inject arbitrary keystrokes via a spoofed Bluetooth HID device.

Analysis

An issue in the Bluetooth Human Interface Device (HID) of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to inject arbitrary keystrokes via a spoofed Bluetooth HID device.

Technical ContextAI

An authentication bypass vulnerability allows attackers to circumvent login mechanisms and gain unauthorized access without valid credentials. This vulnerability is classified as Missing Authentication for Critical Function (CWE-306).

RemediationAI

Implement robust authentication mechanisms. Use multi-factor authentication. Review authentication logic for bypass conditions. Remove default credentials.