An issue in the JXL 9 Inch Car Android Double Din Player Android v12.0 permits an attacker to force the infotainment system into accepting forged GPS signals as legitimate. When triggered, the device reports an incorrect or static location, thereby undermining the integrity of navigation data, potentially enabling geofence evasion, routing manipulation, or other location‑based exploits. The weakness maps to CWE‑941, reflecting improper authentication or authorization of external signal sources.

The vulnerability affects the JXL 9 Inch Car Android Double Din Player running Android v12.0. No additional vendor or product versions are listed, so the scope is limited to this specific infotainment unit.

The CVSS score of 9.1 indicates a high severity impact, while the EPSS score of less than 1% points to a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires the attacker to supply falsified GPS data to the device, which could be achieved through a compromised OBD interface, a physical access to the device, or exploitation of a network channel feeding GPS data. These conditions imply that the attacker needs proximity or compromised input channels, but once achieved, the impact is substantial.