[Suggested description]
An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices.
Any SIM card used with the device
cannot have a PIN configured. If a PIN is configured, the device simply produces a
"Remove PIN and restart!" message, and cannot be used. This makes it easier for
an attacker to use the SIM card by stealing the device.

------------------------------------------

[VulnerabilityType Other]
recommendation to disable common security measures

------------------------------------------

[Vendor of Product]
TK-star

------------------------------------------

[Affected Product Code Base]
TK-Star Q90 Junior GPS horloge - 3.1042.9.8656

------------------------------------------

[Affected Component]
Sim card & PIN

------------------------------------------

[Attack Vectors]
Local

------------------------------------------

[Has vendor confirmed or acknowledged the vulnerability?]
true

------------------------------------------

[Discoverer]
Dennis van Warmerdam, Jasper Nota, Jim Blankendaal

------------------------------------------

[Reference]
https://www.tk-star.com

Use CVE-2019-20473.




With kind regards / Met vriendelijke groet,
Willem Westerhof  | Senior Security Specialist & Public speaker
[Logo, company name  Description automatically generated]
Raising Your Cyber Resilience
E:  willem.westerhof@secura.com<mailto:willem.westerhof@secura.com>
T: +31 6 488 594 22
W: secura.com<https://www.secura.com/>

Follow us on:
[signature_192587247]<https://www.linkedin.com/company/securabv/>  [signature_493676802] <https://twitter.com/SecuraBV>   [signature_235860830] <https://www.youtube.com/c/SecuraBV>
[signature_4021970036]<https://www.secura.com/>