CVE-2025-51643 – Meitrack T366G-L GPS Tracker Unauthenticated SPI Flash Chip Extraction

CVE ID : CVE-2025-51643

Published : Aug. 28, 2025, 4:15 p.m. | 29 minutes ago

Description : Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper protection. An attacker with physical access to the device can use a standard SPI programmer to extract the firmware using flashrom. This results in exposure of sensitive configuration data such as APN credentials, backend server information, and network parameter

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…