MyCar Controls uses hard-coded credentials

published 2020-01-15 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-18867

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 3.6%; EPSS 3.6% chance of exploitation in 30 days, percentile 89%
public exploits: 0; none known

The MyCar Controls of AutoMobility Distribution Inc., mobile application contains hard-coded admin credentials. A remote unauthenticated attacker may be able to send commands to and retrieve data from a target MyCar unit. This may allow the attacker to learn the location of a target, or gain unauthorized physical access to a vehicle. This issue affects AutoMobility MyCar versions prior to 3.4.24 on iOS and versions prior to 4.1.2 on Android. This issue has additionally been fixed in Carlink, Link, Visions MyCar, and MyCar Kia.

Patch / fix

fixed in 1

AutoMobility Distribution Inc. MyCar Controls 3.4.24, 4.1.2

Exploit prediction

3.57% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

AutoMobility Distribution Inc. MyCar Controls

Classification

Weakness

CWE-798 Use of Hard-coded Credentials

References

kb.cert.org /vuls/id/174715/
third-party-advisory, us-government-resource
securityfocus.com /bid/107827
vdb-entry, third-party-advisory
play.google.com /store/apps/details?id=app.com.automobility.mycar.control
product
mycarcontrols.com /
product
itunes.apple.com /us/app/mycar-controls/id1126511815
product

Sources

CVE List CVE-2019-9493
NVD CVE-2019-9493

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary