PT-2020-11355 · Automobility · Automobility Mycar

Jmaxxz · Published 2020-01-15 · Updated 2020-01-24 · CVE-2019-9493

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AutoMobility MyCar versions prior to 3.4.24 on iOS AutoMobility MyCar versions prior to 4.1.2 on Android

Description The mobile application contains hard-coded admin credentials, allowing a remote unauthenticated attacker to send commands to and retrieve data from a target unit. This may enable the attacker to learn the location of a target or gain unauthorized physical access to a vehicle.

Recommendations For AutoMobility MyCar versions prior to 3.4.24 on iOS, update to version 3.4.24 or later. For AutoMobility MyCar versions prior to 4.1.2 on Android, update to version 4.1.2 or later.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2019-9493

Affected Products

Automobility Mycar

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-9493 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9493 · Vendor Advisory
• https://kb.cert.org/vuls/id/174715 · Note
• https://itunes.apple.com/us/app/mycar-controls/id1126511815 · Note
• https://mycarcontrols.com · Note
• https://securityfocus.com/bid/107827 · Note
• https://play.google.com/store/apps/details?id=app.com.automobility.mycar.control · Note