PT-2021-9036 · Tk Star · Tk-Star Q90 Junior Gps

Published 2021-02-01 · Updated 2024-08-01 · CVE-2019-20473

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TK-Star Q90 Junior GPS horloge version 3.1042.9.8656

Description An issue was discovered where any SIM card used with the device cannot have a PIN configured. If a PIN is configured, the device produces a "Remove PIN and restart!" message and cannot be used, making it easier for an attacker to use the SIM card by stealing the device.

Recommendations For version 3.1042.9.8656, consider removing the PIN from the SIM card to allow the device to function, but be aware that this reduces the security of the SIM card. As a temporary workaround, restrict access to the device to minimize the risk of theft and subsequent SIM card exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2019-20473

Affected Products

Tk-Star Q90 Junior Gps

References · 6

• https://tk-star.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20473 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20473 · Vendor Advisory
• https://t.me/cibsecurity/22930 · Telegram Post
• https://eurofins-cybersecurity.com/news/connected-devices-smart-watches · Note
• http://seclists.org/fulldisclosure/2024/Jul/14 · Note