CVE-2025-51643
LOW EPSS 15.6%
Published Aug 28, 202510mo ago · Modified Jun 17, 20262w ago
2.4 CVSS 3.1
Published Aug 28, 2025 10mo ago
Last Modified Jun 17, 2026 2w ago
Description
Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper protection. An attacker with physical access to the device can use a standard SPI programmer to extract the firmware using flashrom. This results in exposure of sensitive configuration data such as APN credentials, backend server information, and network parameter
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector Physical
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
15.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure
Affected Products 2
References 1
- github.com https://github.com/NastyCrow/CVE-2025-51643
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.