PT-2021-9035 · Unknown · Tk-Star Q90 Junior Gps

Published 2021-02-01 · Updated 2024-08-08 · CVE-2019-20471

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TK-Star Q90 Junior GPS horloge version 3.1042.9.8656

Description A security issue was found in the initial setup of the device, where a default password 123456 is used for administrative purposes without prompting the user to change it. This default password can be exploited.

Recommendations For version 3.1042.9.8656, change the default administrative password 123456 to a strong and unique password as soon as possible after initial setup to prevent potential exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2019-20471

Affected Products

Tk-Star Q90 Junior Gps

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2019-20471 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20471 · Vendor Advisory
• https://tk-star.com · Vendor Advisory
• https://t.me/cibsecurity/22931 · Telegram Post
• https://t.me/cvenotify/9509 · Telegram Post
• https://eurofins-cybersecurity.com/news/connected-devices-smart-watches · Note
• https://t.me/cibsecurity/22929 · Telegram Post
• http://seclists.org/fulldisclosure/2024/Jul/14 · Note
• https://t.me/cvenotify/89980 · Telegram Post