PT-2025-11449 · Blackvue · Blackvue App

Geochen · Published 2025-03-17 · Updated 2025-03-17 · CVE-2025-2355

Positive Technologies (AI Summary)

CVSS v2.0

1.7

Low

Base vector

AV:L/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BlackVue App version 3.65

Description A vulnerability was found in the BlackVue App, affecting some unknown functionality of the component API Endpoint Handler. The manipulation of the BCS TOKEN/SECRET KEY argument leads to unprotected storage of credentials. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations As a temporary workaround, consider restricting access to the API Endpoint Handler until a patch is available. Avoid using the BCS TOKEN/SECRET KEY argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-255

CWE-256

Related Identifiers

CVE-2025-2355

Affected Products

Blackvue App

References · 8

• 🔥 https://github.com/geo-chen/BlackVue/blob/main/README.md#finding-2-hardcoded-secrets-exposed-in-plaintext · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-2355 · Security Note
• https://t.me/cvenotify/114975 · Telegram Post
• https://vuldb.com/?ctiid.299822 · Note
• https://vuldb.com/?id.299822 · Note
• https://t.me/cvedetector/20429 · Telegram Post
• https://vuldb.com/?submit.513351 · Note
• https://t.me/cvetracker/19244 · Telegram Post