EUVD-2025-17353Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Default password prevention
|
| Impact | This vulnerability represents a HIGH real-world risk despite not having complete EPSS/KEV/POC data in the provided context. The CVSS 3.0 score of 8.8 (High) with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates: (1) Attack Vector:Adjacent allows exploitation from local network only, reducing internet-facing exposure but increasing risk for any network-connected installation; (2) AC:Low means no special conditions required; (3) PR:None and UI:None indicate trivial exploitation; (4) Impact is complete (Confidentiality, Integrity, Availability all High with root-level code execution). The combination of default credential exploitation, root-level access, and high impact justifies prioritization, particularly for enterprise/fleet deployments of 70mai devices. However, the adjacent network requirement prevents worm-like propagation across the internet, making mass exploitation less likely than directly internet-exposed vulnerabilities. Organizations with 70mai A510 devices on networked systems should treat this as urgent. |
| Exploit ScenarioDerived | An attacker on the same local network as a target 70mai A510 dashcam (e.g., office WiFi, home network, or vehicle's mobile hotspot) discovers the device's IP address via network scanning. The attacker connects to the device's web interface or API endpoint and uses the default credentials to authenticate successfully. Once authenticated, the attacker leverages the root-level access to: (1) extract stored dashcam footage and GPS location data; (2) modify device configuration to disable logging or recording; (3) inject malicious firmware to create a persistent backdoor; (4) use the compromised device as a pivot point to attack other network resources. The entire exploitation chain requires no user interaction, no special tools beyond basic network scanning utilities, and can be completed in minutes. In a fleet management scenario with multiple 70mai devices, a single network compromise could provide attackers with access to all vehicles' location and video data simultaneously. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Critical authentication bypass vulnerability in the 70mai A510 dashcam that exploits default credentials in the device's user account configuration. Network-adjacent attackers can bypass authentication without any credentials and achieve remote code execution with root privileges. This vulnerability presents an immediate and severe risk due to its low attack complexity, lack of user interaction requirement, and the widespread deployment of 70mai dashcams in vehicles.
RemediationAI
Immediate mitigation steps: (1) Change default credentials immediately on all deployed 70mai A510 units if the device supports user-defined passwords; (2) Restrict network access to the dashcam via firewall rules, limiting connectivity to trusted administrative networks only; (3) Disable remote administration features if not required; (4) Isolate dashcam devices to a separate network segment from critical systems. Patch remediation: Monitor 70mai's official security advisories and firmware release channels for a patched firmware version that removes default credentials or enforces mandatory credential change on first boot. Contact 70mai support at their official channels to request patch availability timeline and update procedures. Until a patch is available, implement network segmentation and access controls as primary compensating controls.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The 70mai A510 is a networked dashcam device that implements local authentication mechanisms for administrative access and configuration management. The vulnerability stems from CWE-1393 (Default Configuration), where the device ships with hardcoded or unchanged default credentials in its user account database. This is a common architectural flaw in IoT devices where manufacturers fail to enforce credential generation or randomization during initial provisioning. The affected authentication system likely protects both web-based administration interfaces and potentially API endpoints used for configuration, firmware updates, and log access. Network-adjacent attack surface indicates the device is accessible via local network (WiFi or direct connection) rather than requiring internet access, significantly lowering the practical barrier to exploitation.
Know when A510 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
70mai A510 Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of 70mai A510. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the default configuration of user accounts. The configuration contains default password. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the root. Was ZDI-CAN-24996.
Executive ViewAI
The 70mai A510 devices in your environment are vulnerable to authentication bypass due to hardcoded default credentials, allowing attackers to gain root-level access and execute arbitrary code without any authentication. This poses an immediate risk to any organization operating these devices, particularly those in networked environments, as the vulnerability requires only network adjacency to exploit.
Implement network segmentation to restrict access to 70mai A510 devices; disable remote management interfaces if not required for operations; enforce firewall rules limiting device connectivity to specific trusted endpoints; deploy network monitoring to detect unauthorized access attempts to affected devices; mandate immediate password changes from defaults to strong, unique credentials; consider disabling the device if it is non-critical until a patch or replacement is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC
Exploit-DB