CVE-2019-14951 Security feature bypass in n/a
Attackers can bypass brute-force protections to gain unauthorized access to vehicle multimedia screens via the mobile app's authentication process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-14951?
CVE-2019-14951 is a high-severity vulnerability in n/a, published on 12 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the authentication process, which makes it easier for attackers to obtain multimedia-screen access via port 7050 on the cellular network, as demonstrated by a DrivingRestriction method call to uma/jsonrpc/mobile.
Weakness: CWE-307
Which versions are affected by CVE-2019-14951?
It affects 1 product.
Products include Telenav Scout Gps Link.
How do I fix CVE-2019-14951?
No fix has been published for CVE-2019-14951 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-14951 being exploited?
There is no known exploitation of CVE-2019-14951 in the wild and no public exploit code.
Sources
Also known as GHSA-hhwc-fxxw-wfmx.