PT-2025-28041 · Blackvue · Blackvue Dashcam 590X

Geochen · Published 2025-07-05 · Updated 2025-07-06 · CVE-2025-7076

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: BlackVue Dashcam 590X up to 20250624

Description: A critical issue affects some unknown functionality of the file /upload.cgi of the component Configuration Handler, leading to improper access controls. The attack must be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted about this disclosure but did not respond.

Recommendations: For BlackVue Dashcam 590X up to 20250624, as a temporary workaround, consider restricting access to the /upload.cgi file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Privilege Assignment

Improper Access Control

Weakness Enumeration

CWE-266

CWE-284

Related Identifiers

BDU:2026-07981

CVE-2025-7076

Affected Products

Blackvue Dashcam 590X

References · 11

• 🔥 https://github.com/geo-chen/BlackVue/blob/main/README.md#finding-2-unauthenticated-modifications-to-dashcam-configurations · Exploit
• https://osv.dev/vulnerability/CVE-2025-7076 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7076 · Security Note
• https://bdu.fstec.ru/vul/2026-07981 · Security Note
• https://t.me/cvenotify/127750 · Telegram Post
• https://vuldb.com/?id.314990 · Note
• https://twitter.com/CVEnew/status/1941667818979639332 · Twitter Post
• https://twitter.com/transilienceai/status/1941719351406547007 · Twitter Post
• https://vuldb.com/?submit.603305 · Note
• https://vuldb.com/?ctiid.314990 · Note
• https://twitter.com/VulmonFeeds/status/1941710338082107870 · Twitter Post