MyCar Controls uses hard-coded credentials
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.
Summary
The MyCar Controls of AutoMobility Distribution Inc., mobile application contains hard-coded admin credentials. A remote unauthenticated attacker may be able to send commands to and retrieve data from a target MyCar unit. This may allow the attacker to learn the location of a target, or gain unauthorized physical access to a vehicle. This issue affects AutoMobility MyCar versions prior to 3.4.24 on iOS and versions prior to 4.1.2 on Android. This issue has additionally been fixed in Carlink, Link, Visions MyCar, and MyCar Kia.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AutoMobility Distribution Inc. | MyCar Controls | before 3.4.24 | 3.4.24 | Patch available | CNA |
| AutoMobility Distribution Inc. | MyCar Controls | before 4.1.2 | 4.1.2 | Patch available | CNA |
- MyCar Controls VendorAutoMobility Distribution Inc. Affected before 3.4.24 Fixed in 3.4.24 Patch available CNA
- MyCar Controls VendorAutoMobility Distribution Inc. Affected before 4.1.2 Fixed in 4.1.2 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mycarcontrols:mycar_controls:*:*:*:*:*:iphone_os:*:* | before 3.4.24 | Vulnerable | Mycarcontrols |
| cpe:2.3:a:mycarcontrols:mycar_controls:*:*:*:*:*:android:*:* | before 4.1.2 | Vulnerable | Mycarcontrols |
- cpe:2.3:a:mycarcontrols:mycar_controls:*:*:*:*:*:iphone_os:*:* Versions before 3.4.24 Vulnerable ·Mycarcontrols
- cpe:2.3:a:mycarcontrols:mycar_controls:*:*:*:*:*:android:*:* Versions before 4.1.2 Vulnerable ·Mycarcontrols
Remediation
- Fix · CNA MyCar Controls (AutoMobility Distribution Inc.) Fixed in 3.4.24
- Fix · CNA MyCar Controls (AutoMobility Distribution Inc.) Fixed in 4.1.2
Timeline
- 2026-10-02 Threatist record created from CVE-2019-9493
- 2026-10-03 Alias added: GHSA-54f4-w37j-gj3c
References
Sources
- CVE-2019-9493 · CVE Program
- CVE-2019-9493 · NVD
- FIRST EPSS
- GHSA-54f4-w37j-gj3c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences