关键漏洞信息 Finding 1: CVE-2025-7075 - Unauthenticated Upload Endpoint on HTTP Vulnerability Type: Incorrect Access Control Vendor of Product: BlackVue Affected Product Code Base: BlackVue Dashcam 590X Affected Component: Upload mechanism Attack Type: Remote Impact Code execution: True Impact Information Disclosure: True Attack Vectors: A remote attacker can upload malware onto the dashcam via an unauthenticated upload endpoint on the dashcam's http server. Has vendor confirmed or acknowledged the vulnerability?: Yes Finding 2: CVE-2025-7076 - Unauthenticated Modifications to Dashcam Configurations Vulnerability Type: Incorrect Access Control Vendor of Product: BlackVue Affected Product Code Base: BlackVue Dashcam 590X Affected Component: Unauthenticated Configuration Management Attack Type: Remote Impact Code execution: True Impact Information Disclosure: True Attack Vectors: A remote attacker can leverage on the lack of authentication on configuration management to disable battery protection on the dashcam to drain the car's battery. Has vendor confirmed or acknowledged the vulnerability?: Yes Finding 3: CVE-2025-2355 - Hardcoded secrets exposed in plaintext + client secrets sent via GET Description: In the blackvue v1.8.2 APK, both BCS_TOKEN and SECRET_KEY, along with the API endpoints, are exposed in the BlackVue_3.05_APKPure - jadx-gui. Finding 4: CVE-2025-2356 - Unauthorised API calls to change settings such as delete device Description: While most of the sensitive API endpoints require userToken, that is transmitted via GET parameter. Finding 5: Misconfigured Cloud Devices Exposing Live Feeds, Location, Even Car Plates Description: Not detailed in the screenshot. Disclosure Timeline 25 Feb 2025 - disclosed to BlackVue 26 Feb 2025 - acknowledged by BlackVue 5 Mar 2025 - accepted by BlackVue 16 Mar 2025 - CVEs published