Unencrypted Broadcast Vulnerability in BYD QIN PLUS DM-i Dilink OS
CVE-2025-28169

8.1HIGH

Key Information:

Vendor

BYD

Status
QIN PLUS DM-i Dilink OS
Vendor
CVE Published:
23 April 2025

What is CVE-2025-28169?

The BYD QIN PLUS DM-i Dilink OS versions v3.0_13.1.7.2204050.1 to v3.0_13.1.7.2312290.1_0 transmit data to the manufacturer's cloud server without encryption. This lack of encryption exposes users to potential interception and manipulation by attackers, who can exploit these unprotected broadcasts to carry out man-in-the-middle attacks. Such vulnerabilities pose significant risks to user data privacy and security, highlighting the importance of robust encryption practices in vehicular technology.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://www.byd.com
https://gist.github.com/rainymode/bfd976ecbe0d0b776fd9303...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.