70mai Dashcam Vulnerabilities: Unauth Access, RCE, Info Leak (CVE-2025-30112, CVE-2025-6524-6530, CVE-2025-11942-12915)

70mai Dashcam 1S Vulnerability 1 - CVE-2025-30112: Bypassing Device Pairing Description: Attackers can directly access device APIs and RTSP streams over the network, bypassing physical button pairing. Type: Incorrect Access Control Impact: Information Disclosure Vulnerability 2 - CVE-2025-6524: Unauthorized File Storage Enables Remote Video Dumping and Live Streaming Description: Attackers can download video files and access live video streams without authentication. Type: Incorrect Access Control Impact: Information Disclosure, Potential Remote Code Execution Vulnerability 3 - CVE-2025-6525: Unauthorized Configuration Changes Description: Attackers can remotely modify device configurations, including disabling battery protection. Type: Incorrect Access Control Impact: Configuration Tampering 70mai Dashcam M300 Vulnerability 4 - CVE-2025-6526: Root Password Exposure via Unauthenticated HTTP Server Description: Attackers can access the device’s filesystem using default credentials, exposing the root password. Type: Incorrect Access Control Impact: Penetration Vulnerability 5 - CVE-2025-6527: Remote Dumping of All Sensitive Video and Audio Recordings Description: Attackers can bypass weak authentication to dump video and audio files. Type: Incorrect Access Control Impact: Information Disclosure Vulnerability 6 - CVE-2025-6528: Unauthenticated Live Video Streaming Description: Live video streams are accessible without authentication. Type: Incorrect Access Control Impact: Information Disclosure Vulnerability 7 - CVE-2025-6529: Remote Upload and Execution of Malicious Files Description: Attackers can upload and execute malicious files, even replace firmware. Type: Incorrect Access Control Impact: Remote Code Execution Vulnerability 8 - CVE-2025-6530: Remote Crash of Dashcam Description: Default scripts run automatically during Telnet sessions, which can be exploited to crash the dashcam. Type: Incorrect Access Control Impact: Denial of Service 70mai Dashcam Omni X200 Vulnerability 9 - CVE-2025-11942: Bypassing 70mai Dashcam Omni X200 Device Pairing Description: Similar to Dashcam 1S pairing bypass, but involves more unprotected services. Type: Incorrect Access Control Impact: Information Disclosure, Configuration Tampering Vulnerability 10 - CVE-2025-11943: Root Password Exposure via Unauthenticated HTTP Server Description: Similar to Dashcam M300’s root password exposure issue. Type: Incorrect Access Control Impact: Penetration Vulnerability 11 - CVE-2025-12915: Binary Hijacking Persistence Vulnerability in 70mai X200 Dashcam Startup Script Description: Initialization scripts can be tampered with to植入 malicious binaries, achieving persistent control. Type: Incorrect Access Control, Persistence Impact: Persistent Control The above summary highlights critical security vulnerabilities affecting 70mai dashcams, emphasizing weaknesses in access control, information protection, and system integrity. Users and vendors are advised to prioritize security updates and protective measures.

Goal Reached Thanks to every supporter — we hit 100%!

70mai Dashcam Vulnerabilities: Unauth Access, RCE, Info Leak (CVE-2025-30112, CVE-2025-6524-6530, CVE-2025-11942-12915)

More from this source