TK-Star Q90 Junior GPS Horloge 3.1042.9.8656 Missing PIN

[Suggested description]
An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices.
Any SIM card used with the device
cannot have a PIN configured. If a PIN is configured, the device simply produces a
“Remove PIN and restart!” message, and cannot be used. This makes it easier for
an attacker to use the SIM card by stealing the device.

---

[VulnerabilityType Other]
recommendation to disable common security measures

---

[Vendor of Product]
TK-star

---

[Affected Product Code Base]
TK-Star Q90 Junior GPS horloge - 3.1042.9.8656

---

[Affected Component]
Sim card & PIN

---

[Attack Vectors]
Local

---

[Has vendor confirmed or acknowledged the vulnerability?]
true

---

[Discoverer]
Dennis van Warmerdam, Jasper Nota, Jim Blankendaal

---

[Reference]
https://www.tk-star.com

Use CVE-2019-20473.

With kind regards / Met vriendelijke groet,
Willem Westerhof | Senior Security Specialist & Public speaker
[Logo, company name Description automatically generated]
Raising Your Cyber Resilience
E: [email protected]mailto:[email protected]
T: +31 6 488 594 22
W: secura.comhttps://www.secura.com/

Follow us on:
[signature_192587247]https://www.linkedin.com/company/securabv/ [signature_493676802] https://twitter.com/SecuraBV [signature_235860830] https://www.youtube.com/c/SecuraBV
[signature_4021970036]https://www.secura.com/