EUVD-2025-209278Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system into accepting falsified GPS signals as legitimate, resulting in the device reporting an incorrect or static location.
AnalysisAI
GPS spoofing vulnerability in JXL 9 Inch Car Android Double Din Player (Android 12.0) allows unauthenticated remote attackers to inject falsified GPS signals that the infotainment system accepts as legitimate, forcing incorrect or static location reporting. Exploitation requires no user interaction and achieves high integrity and availability impact through manipulation of navigation data. No public exploit identified at time of analysis. CVSS 9.1 reflects network-accessible attack vector with low complexity.
Technical ContextAI
Root cause stems from insufficient GPS signal validation (CWE-941 incorrectly matched-actual weakness is improper input validation of GNSS data). Device fails to authenticate or verify cryptographic integrity of GPS position data streams, enabling injection of malicious NMEA sentences or spoofed satellite signals. Android 12.0 implementation lacks anti-spoofing mechanisms such as signal strength analysis or multi-source correlation.
RemediationAI
No vendor-released patch identified at time of analysis. Primary vendor advisory channel (http://jxl.com) should be consulted for firmware updates addressing GPS signal authentication. Interim mitigations: disable automatic GPS-based features in infotainment settings, use smartphone-based navigation as independent reference, implement physical anti-spoofing hardware filters if available for aftermarket installation. Fleet operators should monitor for anomalous location jumps via telematics platforms. Detailed vulnerability analysis available at https://github.com/thorat-shubham/JXL_Infotainment_CVE-2025-69515/blob/main/README.md. Contact JXL support directly to request patched firmware or schedule hardware replacement if vulnerability affects critical navigation-dependent systems. Official NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2025-69515
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today