CVE-2019-12500

The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because Bluetooth Low Energy commands have no server-side authentication check. Other affected commands include suddenly braking, locking, and unlocking.

CVSS v3.0

6.5 MEDIUMCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

3.3 LOWAV:A/AC:L/Au:N/C:N/I:P/A:N

EPSS

0.84% chance of exploitation in the next 30 days, 55th percentile

Published

2019-05-31

Updated

2024-08-04

Proof-of-concept exploits (2)

• https://blog.zimperium.com/dont-give-me-a-brake-xiaomi-scooter-hack-enables-dangerous-acc…
• KaoXx/Xiaomi-Electric-Scooter-3-Lite-PoC6★ · 2024-06-13

References

• CVE Record
• NVD entry

Related

• CVE-2022-37706
• CVE-2019-12490
• CVE-2019-12502
• CVE-2019-12489
• CVE-2019-12506
• CVE-2019-12483