PT-2025-7770 · Yi · Yi Car Dashcam

Geo-Chen · Published 2025-02-24 · Updated 2025-03-03 · CVE-2024-56897

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YI Car Dashcam version 3.88

Description The issue is related to improper access control in the HTTP server, allowing unauthorized actions such as unrestricted file downloads and uploads. Additionally, API commands can be made to modify device settings without proper authorization, including disabling recording, disabling sounds, and performing a factory reset.

Recommendations For YI Car Dashcam version 3.88, consider restricting access to the HTTP server and API commands until a patch is available. As a temporary workaround, avoid using the device's API for sensitive operations and limit access to the device's settings to prevent unauthorized modifications.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-56897

Affected Products

Yi Car Dashcam

References · 8

• 🔥 https://geochen.medium.com/cve-2024-56897-yi-car-dashcam-39304a4b21b4 · Exploit
• 🔥 https://github.com/geo-chen/YI-Smart-Dashcam · Exploit
• https://osv.dev/vulnerability/CVE-2024-56897 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56897 · Security Note
• https://yitechnology.com.sg/products/dash-camera · Note
• https://twitter.com/CVEnew/status/1894059291092402207 · Twitter Post
• https://t.me/cvedetector/18798 · Telegram Post
• https://twitter.com/taqtics_ai/status/1896529757270847688 · Twitter Post