CVE-2025-69515

Attack Name

---

📂 Additional Details

Afftected product

• < JXL 9 Inch Car Android Double Din Player - Android version 12.0 >

Affected Components

• GNSS Receiver Module / GPS Chipset
• Infotainment Navigation Module
• Location Services Framework

Attack Vector

• The infotainment unit can be targeted by broadcasting spoofed GPS signals using an SDR device. Because the GNSS input path lacks integrity validation, the system may accept stronger spoofed signals transmitted from nearby, enabling remote location manipulation without physical access.

CVSS Score : 5.4

• AV:A (Adjacent): Attacker must be in RF proximity to broadcast spoofed GPS signals
• AC:L (Low): No complex conditions beyond signal transmission
• PR:N (None): No authentication required
• UI:N (None): No user interaction needed
• S:U (Unchanged): Impact limited to the infotainment system
• C:N (None): No data confidentiality impact
• I:L (Low): Integrity impact (location data manipulated)
• A:L (Low): Availability impact (navigation reliability affected)

Credits

• Researcher: Shubham S. Thorat
• Organization: Payatu Security Consulting Pvt. Ltd.

📜 References

• CVE-2025-69515 Report

POC