EUVD-2025-18959Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was found in 70mai M300 up to 20250611 and classified as critical. Affected by this issue is some unknown functionality of the component Telnet Service. The manipulation leads to use of default credentials. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Remote code execution via default Telnet credentials in 70mai M300 dashcam firmware (versions up to 20250611) allows adjacent network attackers to gain full device control without authentication. The vulnerability has public exploit code available on GitHub demonstrating malicious file upload and code execution capabilities. Despite CVSS 7.4 severity and public exploitation techniques, EPSS probability remains low at 0.18% (40th percentile), suggesting limited widespread targeting of consumer dashcam devices, though adjacent network requirement (AV:A) makes this exploitable in shared WiFi environments or vehicle networks.
Technical ContextAI
The 70mai M300 is a consumer dashcam device running embedded Linux firmware with network connectivity features. The Telnet service (TCP port 23) is enabled by default with hardcoded factory credentials, representing CWE-1392 (Use of Default Credentials). Telnet transmits credentials in cleartext and provides direct shell access to the underlying operating system. The CVSS 4.0 vector indicates adjacent network attack vector (AV:A), meaning exploitation requires the attacker to be on the same network segment as the device - typically the dashcam's WiFi hotspot or a connected vehicle network. The CPE identifier cpe:2.3:o:70mai:m300_firmware confirms this affects the device firmware/operating system layer rather than a specific application component.
RemediationAI
No vendor-released patch identified at time of analysis despite early disclosure attempts. Immediate mitigation: disable the Telnet service if device firmware provides this option through settings or configuration file modification (check /etc/inetd.conf or systemd service files if root access possible). If Telnet cannot be disabled, change default credentials immediately through command-line interface - however, without vendor documentation, correct credential modification procedure is unknown and may brick the device. Most effective compensating control: disable the dashcam's WiFi hotspot feature entirely and restrict connectivity to USB-only data transfer when possible, eliminating the adjacent network attack vector. For fleet deployments requiring WiFi connectivity, isolate dashcam networks from other vehicle systems using VLAN segmentation and implement MAC address filtering to allow only authorized management devices. Monitor for unauthorized Telnet connection attempts on TCP port 23. Trade-offs: disabling WiFi eliminates remote file retrieval convenience; credential changes risk device lockout without vendor reset procedure.
Share
External POC / Exploit Code
Leaving vuln.today