Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper protection. An attacker with physical access to the device can use a standard SPI programmer to extract the firmware using flashrom. This results in exposure of sensitive configuration data such as APN credentials, backend server information, and network parameter
References
| Link | Resource |
|---|---|
| https://github.com/NastyCrow/CVE-2025-51643 | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
02 Oct 2025, 18:51
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Meitrack t366l-g
Meitrack t366l-g Firmware |
|
| CPE | cpe:2.3:h:meitrack:t366g-l:-:*:*:*:*:*:*:* |
cpe:2.3:o:meitrack:t366l-g_firmware:t366l_y24h131v039:*:*:*:*:*:*:* cpe:2.3:h:meitrack:t366l-g:-:*:*:*:*:*:*:* |
09 Sep 2025, 18:35
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:meitrack:t366g-l_firmware:t366l_y24h131v039:*:*:*:*:*:*:* cpe:2.3:h:meitrack:t366g-l:-:*:*:*:*:*:*:* |
|
| References | () https://github.com/NastyCrow/CVE-2025-51643 - Third Party Advisory | |
| First Time |
Meitrack
Meitrack t366g-l Firmware Meitrack t366g-l |
28 Aug 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-200 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 2.4 |
28 Aug 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-28 16:15
Updated : 2025-10-02 18:51
NVD link : CVE-2025-51643
Mitre link : CVE-2025-51643
CVE.ORG link : CVE-2025-51643
JSON object : View
Products Affected
meitrack
- t366l-g_firmware
- t366l-g
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor