PT-2025-44991 · Cfmoto · Cfmoto Ride

Published 2025-11-04 · Updated 2025-11-10 · CVE-2025-11690

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions CFMOTO RIDE (affected versions not specified)

Description An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users’ vehicles. Exploiting this issue enables an attacker to retrieve data such as GPS coordinates, encryption keys, initialization vectors, model numbers, and fuel statistics belonging to other users, instead of being limited to their own vehicle data. This requires a server-side authorization fix.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-11690

Affected Products

Cfmoto Ride

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-11690 · Security Note
• https://t.me/cveNotify/141529 · Telegram Post
• https://t.me/CVEtracker/36505 · Telegram Post
• https://t.me/cveNotify/142258 · Telegram Post
• https://medium.com/@ilnur.khakimov_86612/how-i-hacked-100-000-motorcycles-including-my-own-666bdb702b7d · Note
• https://advisories.ncsc.nl/2025/ncsc-2025-0350.html · Note