CVE-2019-9493: The MyCar Controls of AutoMobility Distribution Inc., mobile application contains hard-coded admin credentials. A remote unauthenticated attacker may be able…

PriorityP264critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

3.57%

87.9th percentile

The MyCar Controls of AutoMobility Distribution Inc., mobile application contains hard-coded admin credentials. A remote unauthenticated attacker may be able to send commands to and retrieve data from a target MyCar unit. This may allow the attacker to learn the location of a target, or gain unauthorized physical access to a vehicle. This issue affects AutoMobility MyCar versions prior to 3.4.24 on iOS and versions prior to 4.1.2 on Android. This issue has additionally been fixed in Carlink, Link, Visions MyCar, and MyCar Kia.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
automobility_distribution_inc	mycar_controls	>= unspecified < 3.4.24	3.4.24
automobility_distribution_inc	mycar_controls	>= unspecified < 4.1.2	4.1.2
mycarcontrols	mycar_controls	< 3.4.24	3.4.24
mycarcontrols	mycar_controls	< 4.1.2	4.1.2

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.