PT-2025-11613 · Forvia Hella · Hella Driving Recorder Dr 820

Published 2025-03-18 · Updated 2025-03-21 · CVE-2025-30113

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Forvia Hella HELLA Driving Recorder DR 820 (affected versions not specified)

Description An issue exists where hardcoded credentials are present in the APK for ports 9091 and 9092. The dashcam's Android application contains these credentials, allowing unauthorized access to device settings through the mentioned ports. These credentials, stored in cleartext, can be exploited by an attacker who gains access to the dashcam's network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-30113

Affected Products

Hella Driving Recorder Dr 820

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-30113 · Security Note
• https://github.com/geo-chen/Hella · Note
• https://twitter.com/CVEnew/status/1902009885962711186 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1902019386249973782 · Twitter Post
• https://t.me/cvetracker/19374 · Telegram Post
• https://t.me/cvedetector/20580 · Telegram Post
• https://medium.com/@geochen/cve-draft-hella-driving-recorder-dr-820-ff8c4e2cca26 · Note
• https://t.me/cvenotify/115645 · Telegram Post