Which versions of 70mai 1S are affected by CVE-2025-6524?

CVE-2025-6524 is a low-severity vulnerability in 70mai 1S involving authentication failure (CVSS 3.1).

How to fix or mitigate CVE-2025-6524?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

70mai 1S CVE-2025-6524

Q: What is the CVSS score of CVE-2025-6524?

CVE-2025-6524 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-28747 LOW

Improper Authentication (CWE-287)

2025-06-23 cna@vuldb.com

Authentication Bypass

1.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.3 LOW

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.1 LOW

Adjacent network required, high complexity, no privileges, low confidentiality impact.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.1 (LOW) 1.3 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 22:10 euvd

EUVD-2025-28747

Analysis Generated

Mar 15, 2026 - 22:10 vuln.today

CVE Published

Jun 23, 2025 - 21:15 nvd

LOW 3.1

DescriptionCVE.org

A vulnerability classified as problematic has been found in 70mai 1S up to 20250611. This affects an unknown part of the component Video Services. The manipulation leads to improper authentication. Access to the local network is required for this attack to succeed. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authentication in 70mai 1S dashcam up to firmware 20250611 allows local network attackers to access video footage and live streams without credentials. A public exploit exists, but exploitation is difficult due to high attack complexity and local network access requirement. No active exploitation in CISA KEV.

Technical ContextAI

The vulnerability affects the Video Services component of 70mai 1S dashcam, which handles video storage and streaming. CWE-287 (Improper Authentication) indicates the software fails to properly verify identity before granting access to video files or live streams. CPE data is not provided, but the affected product is a consumer dashcam with firmware version up to 20250611. The attack requires local network access, suggesting the device exposes services on the local network without authentication.

RemediationAI

No vendor-released patch identified at time of analysis. As a compensating control, restrict network access to the dashcam by placing it on a separate VLAN or disabling unnecessary network services. Users should monitor for firmware updates from 70mai. Side effect: limiting network access may reduce convenience of remote viewing.