TK-Star Q90 Junior GPS Horloge 3.1042.9.8656 Missing PIN

[Suggested description]An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices.
Any SIM card used with the device
cannot have a PIN configured. If a PIN is configured, the device simply produces a
“Remove PIN and restart!” message, and cannot be used. This makes it easier for
an attacker to use the SIM card by stealing the device.

——————————————

[VulnerabilityType Other]recommendation to disable common security measures

——————————————

[Vendor of Product]TK-star

——————————————

[Affected Product Code Base]TK-Star Q90 Junior GPS horloge – 3.1042.9.8656

——————————————

[Affected Component]Sim card & PIN

——————————————

[Attack Vectors]Local

——————————————

[Has vendor confirmed or acknowledged the vulnerability?]true

——————————————

[Discoverer]Dennis van Warmerdam, Jasper Nota, Jim Blankendaal

——————————————

[Reference]https://www.tk-star.com

Use CVE-2019-20473.

With kind regards / Met vriendelijke groet,
Willem Westerhof | Senior Security Specialist & Public speaker
[Logo, company name Description automatically generated]Raising Your Cyber Resilience
E: willem.westerhof@secura.com<mailto:willem.westerhof@secura.com>
T: +31 6 488 594 22
W: secura.com<https://www.secura.com/>

Follow us on:
[signature_192587247]<https://www.linkedin.com/company/securabv/> [signature_493676802] <https://twitter.com/SecuraBV> [signature_235860830] <https://www.youtube.com/c/SecuraBV>
[signature_4021970036]<https://www.secura.com/>