EUVD-2025-18956Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan local network for M300 device
-
DeliverySend HTTP request to device's HTTP server
-
ExploitReceive root password in response
-
ExecutionUse credentials to access device admin interface
-
ImpactExtract sensitive data or modify settings
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
|
| Exploitation Conditions | Requires local network access (AV:A) and high attack complexity (AC:H). The attacker must be on the same network segment as the device. No authentication required (PR:N). The HTTP server must be enabled and reachable. The exploit is publicly available but described as difficult. |
| Impact | CVSS 4.0 base score is 1.3 (Low) with vector AV:A/AC:H/PR:N/UI:N/VC:L, indicating low confidentiality impact, high attack complexity, and adjacency network only. EPSS score is 0.05% (15th percentile), suggesting very low exploitation probability. Public exploit code exists but exploitation is described as difficult. No KEV listing. Overall risk is low due to high complexity and local network requirement, despite public exploit. |
| Exploit ScenarioDerived | An attacker on the same local network as the 70mai M300 dashcam sends a crafted HTTP request to the device's HTTP server. The server responds with the root password in plaintext, allowing the attacker to gain administrative access to the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Exposed root password via unauthenticated HTTP server in 70mai M300 dashcam firmware up to 20250611 allows local network attackers to obtain credentials. Public exploit code exists, but exploitation is difficult and requires local network access. No active exploitation in CISA KEV.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch identified at time of analysis. As a compensating control, restrict network access to the dashcam's HTTP server by placing it on a separate VLAN or disabling the HTTP server if possible. Block port 80/tcp on the device from untrusted networks. Note that disabling the HTTP server may affect legitimate functionality. Monitor for vendor updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the HTTP server component of the 70mai M300 dashcam firmware. CWE-522 (Insufficiently Protected Credentials) indicates that the device stores or transmits credentials in a manner that can be accessed or decoded by an attacker. The CPE cpe:2.3:o:70mai:m300_firmware:*:*:*:*:*:*:*:* confirms the affected product is the firmware of the M300 model. The HTTP server likely exposes a root password without proper authentication or encryption, allowing anyone on the local network to retrieve it.
Know when M300 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Adjacent network, high complexity, no privileges, low confidentiality impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability, which was classified as problematic, has been found in 70mai M300 up to 20250611. This issue affects some unknown processing of the component HTTP Server. The manipulation leads to insufficiently protected credentials. The attack can only be done within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
CVE-2025-6526 is a low-severity vulnerability in 70mai M300 (CVSS 3.1). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in M300 Firmware
View allRemote code execution via default Telnet credentials in 70mai M300 dashcam firmware (versions up to 20250611) allows adj
Denial of service in 70mai M300 dashcam firmware up to 20250611 allows an attacker on the local network to crash the dev
Improper authentication in 70mai M300 dashcam firmware up to 20250611 allows local network attackers to access the RTSP
A security vulnerability in 70mai M300 (CVSS 3.1). Risk factors: public PoC available.
Exploit-DB