CVE-2025-63822

Received Received - Intake

Incorrect Access Control in SirenGPS Android App

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: MITRE

Description

SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the requesting user is authorized to access the target user's data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-05

Generated

2026-08-06

AI Q&A

2026-08-06

EPSS Evaluated

N/A

NVD

CVE-2025-63822

Affected Vendors & Products

Vendor	Product	Version / Range
sirengps	sirengps_android_application	2.19.44

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an Incorrect Access Control flaw in the SirenGPS Android app version 2.19.44. An attacker who is already authenticated can change user identifier parameters in API requests to bypass security checks. This allows them to read and modify other users' personal data without permission.

Detection Guidance

This vulnerability involves an authenticated attacker manipulating user identifier parameters to access unauthorized data. To detect it, monitor API logs for unusual requests where user IDs are modified or accessed without proper authorization. Check for repeated requests to endpoints handling personal data with varying user IDs.

Impact Analysis

If you use the SirenGPS app, an attacker could access your personal information such as location data, contact details, or other sensitive data. They could also alter your account details, leading to potential misuse of your profile or data leaks.

Compliance Impact

This vulnerability likely violates data protection regulations like GDPR and HIPAA by failing to ensure proper access controls. It could result in unauthorized data exposure, leading to legal penalties, fines, or reputational damage for organizations using the app.

Mitigation Strategies

Immediately update the SirenGPS Android Application to the latest version if a patch is available. Implement strict input validation for user identifier parameters in API requests. Ensure proper authorization checks are enforced server-side for all data access requests.

Hi! I’m here to help you understand CVE-2025-63822. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70