CVE-2025-63896
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability in the Bluetooth HID module of JXL 9 Inch Car Android Double Din Player running Android 12.0 allows an attacker to inject arbitrary keystrokes by spoofing a Bluetooth HID device.
Risk Assessment
An attacker can remotely take control of the vehicle's infotainment system, performing unauthorized actions such as changing settings, launching applications, or extracting data.
Recommendation
Immediately update the device firmware to the latest version provided by the manufacturer and disable unused Bluetooth services.
Other vulnerabilities in JXL 9 Inch Car Android Double Din Player
See all- CVE-2025-69515Critical
An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system into accepting falsified GPS signals as legitimate, resulting in the device reporting an incorrect or static location.
- CVE-2025-63895High
A vulnerability in the Bluetooth firmware of the JXL 9 Inch Car Android Double Din Player running Android 12.0 allows an attacker to cause a Denial of Service (DoS) by sending a crafted Link Manager Protocol (LMP) packet.
Original NVD description (English source)
An issue in the Bluetooth Human Interface Device (HID) of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to inject arbitrary keystrokes via a spoofed Bluetooth HID device.