PT-2025-12665 · 70Mai · 70Mai Dash Cam 1S

Publicado 2025-03-24 · Atualizado 2025-03-26 · CVE-2025-30112

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions 70mai Dash Cam 1S devices (affected versions not specified)

Description The issue allows an attacker to bypass the device authorization mechanism by connecting directly to the dashcam's network and accessing the API on port 80 and RTSP on port 554. This bypasses the requirement for a user to physically press the power button during a connection.

Recommendations For 70mai Dash Cam 1S devices, as a temporary workaround, consider restricting access to the API on port 80 and RTSP on port 554 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

CVE-2025-30112

Produtos afetados

70Mai Dash Cam 1S

Referências · 7

• 🔥 https://github.com/geo-chen/70mai/blob/main/README.md#finding-1---cve-2025-30112-bypass-device-pairing-of-70mai-dashcam-1s · Exploit
• https://t.me/cvedetector/20986 · Publicação no Telegram
• https://70mai.com/cam1s · Nota
• https://twitter.com/CVEnew/status/1904224910505099446 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-30112 · Nota de Segurança
• https://t.me/cvetracker/19779 · Publicação no Telegram
• https://twitter.com/cybercronai/status/1904858521360859328 · Publicação no Twitter