CVE-2025-11690: IDOR vulnerability in the CFMOTO RIDE API
An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users’ vehicles. Exploiting this issue enables an attacker to retrieve data such as GPS coordinates, encryption keys, initialization vectors, model numbers, and fuel statistics belonging to other users, instead of being limited to their own vehicle data. The fix for this vulnerability is a server-side authorization fix.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11690?
CVE-2025-11690 is classified as a critical severity vulnerability due to its potential to expose sensitive user data.
How do I fix CVE-2025-11690?
To remediate CVE-2025-11690, implement proper access controls and validation mechanisms on the vehicleId parameter.
What type of vulnerability is CVE-2025-11690?
CVE-2025-11690 is an Insecure Direct Object Reference (IDOR) vulnerability.
What are the potential impacts of exploiting CVE-2025-11690?
Exploiting CVE-2025-11690 can lead to unauthorized access to users' sensitive vehicle information, including GPS coordinates and encryption keys.
Which software is affected by CVE-2025-11690?
CVE-2025-11690 affects the CFMOTO RIDE API.