CVE-2025-11690

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11690", "assignerOrgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "state": "PUBLISHED", "assignerShortName": "NCSC-NL", "dateReserved": "2025-10-13T14:34:20.917Z", "datePublished": "2025-11-04T10:25:45.416Z", "dateUpdated": "2025-11-10T18:24:47.168Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "shortName": "NCSC-NL", "dateUpdated": "2025-11-10T12:22:52.347Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "title": "IDOR vulnerability in the CFMOTO RIDE API", "affected": [{"vendor": "CFMOTO", "product": "RIDE", "versions": [{"version": "1", "status": "affected", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users\u2019 vehicles. Exploiting this issue enables an attacker to retrieve data such as GPS coordinates, encryption keys, initialization vectors, model numbers, and fuel statistics belonging to other users, instead of being limited to their own vehicle data. The fix for this vulnerability is a server-side authorization fix."}], "references": [{"url": "https://advisories.ncsc.nl/2025/ncsc-2025-0350.html", "name": "NCSC", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N/E:F/RL:O/RC:C", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "exploitCodeMaturity": "FUNCTIONAL", "remediationLevel": "OFFICIAL_FIX", "reportConfidence": "CONFIRMED", "temporalScore": 7.9, "temporalSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "modifiedAttackComplexity": "LOW", "modifiedPrivilegesRequired": "LOW", "modifiedUserInteraction": "NONE", "modifiedScope": "CHANGED", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "LOW", "modifiedAvailabilityImpact": "NONE", "environmentalScore": 7.9, "environmentalSeverity": "HIGH"}}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-04T20:19:43.802129Z", "id": "CVE-2025-11690", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T20:20:24.720Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-10T18:24:47.168Z"}, "references": [{"url": "https://medium.com/@ilnur.khakimov_86612/how-i-hacked-100-000-motorcycles-including-my-own-666bdb702b7d"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://medium.com/@ilnur.khakimov_86612/how-i-hacked-100-000-motorcycles-including-my-own-666bdb702b7d"}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-10T18:24:47.168Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11690", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-04T20:19:43.802129Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T20:20:03.747Z"}}], "cna": {"title": "IDOR vulnerability in the CFMOTO RIDE API", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N/E:F/RL:O/RC:C", "modifiedScope": "CHANGED", "temporalScore": 7.9, "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "remediationLevel": "OFFICIAL_FIX", "reportConfidence": "CONFIRMED", "temporalSeverity": "HIGH", "availabilityImpact": "NONE", "environmentalScore": 7.9, "privilegesRequired": "LOW", "exploitCodeMaturity": "FUNCTIONAL", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "confidentialityImpact": "HIGH", "environmentalSeverity": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "LOW", "modifiedUserInteraction": "NONE", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "NONE", "modifiedPrivilegesRequired": "LOW", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "CFMOTO", "product": "RIDE", "versions": [{"status": "affected", "version": "1", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://advisories.ncsc.nl/2025/ncsc-2025-0350.html", "name": "NCSC", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users\u2019 vehicles. Exploiting this issue enables an attacker to retrieve data such as GPS coordinates, encryption keys, initialization vectors, model numbers, and fuel statistics belonging to other users, instead of being limited to their own vehicle data. The fix for this vulnerability is a server-side authorization fix."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "shortName": "NCSC-NL", "dateUpdated": "2025-11-10T12:22:52.347Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11690", "state": "PUBLISHED", "dateUpdated": "2025-11-10T18:24:47.168Z", "dateReserved": "2025-10-13T14:34:20.917Z", "assignerOrgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "datePublished": "2025-11-04T10:25:45.416Z", "assignerShortName": "NCSC-NL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "RIDE", "vendor": "CFMOTO", "versions": [{"status": "affected", "version": "1", "versionType": "custom"}]}], "source": "cert@ncsc.nl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users\u2019 vehicles. Exploiting this issue enables an attacker to retrieve data such as GPS coordinates, encryption keys, initialization vectors, model numbers, and fuel statistics belonging to other users, instead of being limited to their own vehicle data. The fix for this vulnerability is a server-side authorization fix."}, {"lang": "es", "value": "Una vulnerabilidad de Referencia Directa a Objeto Insegura (IDOR) existe en el par\u00e1metro 'vehicleId', permitiendo acceso no autorizado a informaci\u00f3n sensible de veh\u00edculos de otros usuarios. La explotaci\u00f3n de este problema permite a un atacante recuperar datos como coordenadas GPS, claves de cifrado, vectores de inicializaci\u00f3n, n\u00fameros de modelo y estad\u00edsticas de combustible pertenecientes a otros usuarios, en lugar de estar limitado a los datos de su propio veh\u00edculo. La soluci\u00f3n para esta vulnerabilidad es una correcci\u00f3n de autorizaci\u00f3n del lado del servidor."}], "id": "CVE-2025-11690", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.7, "source": "cert@ncsc.nl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11690", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-04T20:19:43.802129Z", "version": "2.0.3"}}]}, "published": "2025-11-04T11:15:37.573", "references": [{"source": "cert@ncsc.nl", "url": "https://advisories.ncsc.nl/2025/ncsc-2025-0350.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://medium.com/@ilnur.khakimov_86612/how-i-hacked-100-000-motorcycles-including-my-own-666bdb702b7d"}], "sourceIdentifier": "cert@ncsc.nl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "cert@ncsc.nl", "type": "Secondary"}]}

{}

{"created": "2025-11-04T16:32:54.075771+00:00", "updated": "2025-11-04T16:32:54.075807+00:00", "vendors": ["cfmoto", "cfmoto$PRODUCT$ride"]}