PT-2023-21318 · Blackvue · Blackvue Dr750-2Ch Lte

Eyjhb · Published 2023-04-13 · Updated 2023-04-25 · CVE-2023-27748

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BlackVue DR750-2CH LTE version 1.012 2022.10.26

Description The issue concerns the lack of authenticity check for uploaded firmware, allowing attackers to upload crafted firmware that contains backdoors and enables arbitrary code execution.

Recommendations For BlackVue DR750-2CH LTE version 1.012 2022.10.26, as a temporary workaround, consider restricting access to firmware uploads until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2023-27748

Affected Products

Blackvue Dr750-2Ch Lte

References · 7

• 🔥 https://github.com/eyJhb/blackvue-cve-2023 · Exploit
• 🔥 https://github.com/eyJhb/blackvue-cve-2022 · Exploit
• https://osv.dev/vulnerability/CVE-2023-27748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27748 · Security Note
• https://shop.blackvue.com/product/dr750-2ch-ir-lte · Note
• https://blackvue.com · Note
• https://t.me/cibsecurity/62081 · Telegram Post