PT-2025-26653 · 70Mai · 70Mai M300

Geochen · Published 2025-06-23 · Updated 2025-11-14 · CVE-2025-6530

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: 70mai M300 up to 20250611

Description: A vulnerability was found in the Telnet Service component, affecting an unknown part of the file demo.sh. The manipulation leads to denial of service. Access to the local network is required for this attack. The complexity of an attack is rather high, and the exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations: For 70mai M300 up to 20250611, as a temporary workaround, consider disabling the Telnet Service until a patch is available. Restrict access to the local network to minimize the risk of exploitation. Avoid using the demo.sh file in the Telnet Service component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2025-6530

Affected Products

70Mai M300

References · 11

• 🔥 https://github.com/geo-chen/70mai/blob/main/README.md#finding-8-remotely-crashing-the-dashcam · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-6530 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6530 · Vendor Advisory
• https://t.me/cveNotify/142790 · Telegram Post
• https://vuldb.com/?id.313647 · Note
• https://twitter.com/CVEnew/status/1937291990284095498 · Twitter Post
• https://vuldb.com/?ctiid.313647 · Note
• https://t.me/cveNotify/142780 · Telegram Post
• https://vuldb.com/?submit.595451 · Note
• https://t.me/cvenotify/126429 · Telegram Post
• https://t.me/cvetracker/26884 · Telegram Post