PT-2025-26650 · 70Mai · 70Mai M300

Geochen · Published 2025-06-23 · Updated 2025-11-14 · CVE-2025-6527

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: 70mai M300 versions up to 20250611

Description: A problematic issue was found in the Web Server component, affecting an unknown function. This leads to improper access controls. The attack can only be initiated within the local network and has a rather high complexity, with difficult exploitability. The exploit has been disclosed to the public.

Recommendations: For 70mai M300 versions up to 20250611, consider restricting access to the Web Server component to minimize the risk of exploitation. As a temporary workaround, consider disabling unknown functions of the Web Server component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2025-6527

Affected Products

70Mai M300

References · 9

• 🔥 https://github.com/geo-chen/70mai/blob/main/README.md#finding-5-remotely-dump-all-sensitive-video--audio-recordings · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-6527 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6527 · Vendor Advisory
• https://t.me/cveNotify/142787 · Telegram Post
• https://vuldb.com/?ctiid.313644 · Note
• https://t.me/cvetracker/26881 · Telegram Post
• https://vuldb.com/?submit.595448 · Note
• https://twitter.com/CVEnew/status/1937273505709801585 · Twitter Post
• https://vuldb.com/?id.313644 · Note