PT-2025-12665 · 70Mai · 70Mai Dash Cam 1S

Published 2025-03-24 · Updated 2025-03-26 · CVE-2025-30112

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions 70mai Dash Cam 1S devices (affected versions not specified)

Description The issue allows an attacker to bypass the device authorization mechanism by connecting directly to the dashcam's network and accessing the API on port 80 and RTSP on port 554. This bypasses the requirement for a user to physically press the power button during a connection.

Recommendations For 70mai Dash Cam 1S devices, as a temporary workaround, consider restricting access to the API on port 80 and RTSP on port 554 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-30112

Affected Products

70Mai Dash Cam 1S

References · 7

• 🔥 https://github.com/geo-chen/70mai/blob/main/README.md#finding-1---cve-2025-30112-bypass-device-pairing-of-70mai-dashcam-1s · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-30112 · Security Note
• https://t.me/cvedetector/20986 · Telegram Post
• https://70mai.com/cam1s · Note
• https://twitter.com/CVEnew/status/1904224910505099446 · Twitter Post
• https://t.me/cvetracker/19779 · Telegram Post
• https://twitter.com/cybercronai/status/1904858521360859328 · Twitter Post