SinoTrack ST-909 Security Issues

zac 6 hours ago

Hello all,
Fairly new at this. I recently onboarded a SinoTrack device ST-909 with hosted traccar. Everything works as expected, but I'm unclear how to actually secure the device.
What I find is that I can change the default admin password successfully (777xxxxyyyy); I can set a control number successfully ([10-digit-number][password] 1), but the device will always respond to RCONF with the current password in plaintext, and it will always allow anyone with the password to change the control number. Does anyone with a SinoTrack device know what I might be missing?
TIA.