CVE-2019-12500

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-05-31 · updated 2026-06-17
Weakness: CWE-306

Description

The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because Bluetooth Low Energy commands have no server-side authentication check. Other affected commands include suddenly braking, locking, and unlocking.

Affected products

Mi M365 Firmware: before 1.5.1 — fixed in 1.5.1

How to fix

Upgrade to a fixed version: Mi M365 Firmware 1.5.1. Check the vendor advisory for mitigations.

References

https://blog.zimperium.com/dont-give-me-a-brake-xiaomi-scooter-hack-enables-dangerous-accelerations-and-stops-for-unsuspecting-riders/
https://blog.zimperium.com/dont-give-me-a-brake-xiaomi-scooter-hack-enables-dangerous-accelerations-and-stops-for-unsuspecting-riders/

Get alerted when CVE-2019-12500 or the next vulnerability affects your stack