PT-2025-26654 · Unknown · Sifusm/Mzzyg Bd S1

Geochen · Published 2025-06-23 · Updated 2025-06-24 · CVE-2025-6531

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SIFUSM/MZZYG BD S1 up to 20250611

Description: A vulnerability was found in the component RTSP Live Video Stream Endpoint, leading to improper access controls. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. This dashcam is distributed by multiple resellers and different names.

Recommendations: For SIFUSM/MZZYG BD S1 up to 20250611, consider restricting access to the RTSP Live Video Stream Endpoint to minimize the risk of exploitation. As a temporary workaround, limit access to the local network to reduce the potential for attack. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2025-6531

Affected Products

Sifusm/Mzzyg Bd S1

References · 8

• 🔥 https://github.com/geo-chen/BD · Exploit
• 🔥 https://github.com/geo-chen/BD?tab=readme-ov-file#finding-1-unauthenticated-access-of-livestream-and-download-of-video-recordings · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-6531 · Security Note
• https://twitter.com/CVEnew/status/1937294875642462271 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1937322236970480057 · Twitter Post
• https://vuldb.com/?ctiid.313648 · Note
• https://vuldb.com/?id.313648 · Note
• https://vuldb.com/?submit.595452 · Note