CVE-2025-11690

{
  "id": "CVE-2025-11690",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-04T11:15:37.573",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users’ vehicles. Exploiting this issue enables an attacker to retrieve data such as GPS coordinates, encryption keys, initialization vectors, model numbers, and fuel statistics belonging to other users, instead of being limited to their own vehicle data. The fix for this vulnerability is a server-side authorization fix."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Referencia Directa a Objeto Insegura (IDOR) existe en el parámetro 'vehicleId', permitiendo acceso no autorizado a información sensible de vehículos de otros usuarios. La explotación de este problema permite a un atacante recuperar datos como coordenadas GPS, claves de cifrado, vectores de inicialización, números de modelo y estadísticas de combustible pertenecientes a otros usuarios, en lugar de estar limitado a los datos de su propio vehículo. La solución para esta vulnerabilidad es una corrección de autorización del lado del servidor."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "CFMOTO",
          "product": "RIDE",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-04T20:19:43.802129Z",
          "id": "CVE-2025-11690",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://advisories.ncsc.nl/2025/ncsc-2025-0350.html",
      "source": "[email protected]"
    },
    {
      "url": "https://medium.com/@ilnur.khakimov_86612/how-i-hacked-100-000-motorcycles-including-my-own-666bdb702b7d",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}