70mai M300 EUVD-2025-18959

Exploitation requires the attacker to be on the same network segment as the dashcam (adjacent network access per CVSS AV:A). Specifically, the attacker must either be within WiFi range of the vehicle when the dashcam's hotspot is active, or the dashcam must be connected to a shared network accessible to the attacker (such as fleet management WiFi in parking facilities). The Telnet service must be enabled, which is the default configuration. No authentication is effectively required due to default credentials (CVSS PR:N). No user interaction needed (UI:N). Limiting factors: physical proximity requirement (WiFi range typically 30-100 feet), dashcam must be powered on with WiFi enabled, and attacker must know or guess the WiFi SSID if not broadcasting. Vehicles in isolated parking or garages face lower risk than those in public parking structures or fleet yards with multiple network-connected devices.

Real-world risk assessment reveals conflicting signals requiring nuanced interpretation. CVSS 7.4 (High) reflects complete device compromise potential with no authentication barriers. The adjacent network requirement (AV:A) significantly limits exposure compared to internet-facing vulnerabilities - attackers must be within WiFi range of the vehicle or connect to the dashcam's hotspot. Public exploit code exists on GitHub showing concrete exploitation steps for file upload and code execution, elevating practical risk beyond theoretical. However, EPSS 0.18% (40th percentile) indicates security researchers assess low probability of mass exploitation, likely because consumer dashcams represent low-value targets compared to enterprise infrastructure. The vendor's non-responsiveness to disclosure is concerning for long-term risk, as no patch timeline exists. Priority depends heavily on deployment context: fleet vehicles with networked dashcams in parking facilities face higher risk than personal vehicles with isolated dashcam WiFi. Not CISA KEV-listed, suggesting no observed targeting in critical infrastructure or enterprise environments.

An attacker parks within WiFi range of a target vehicle equipped with a 70mai M300 dashcam or connects to the dashcam's open WiFi hotspot (often named '70mai_M300_[serial]'). Using the publicly available GitHub exploit code, they connect to the Telnet service on TCP port 23 using default factory credentials. Once authenticated, the attacker uploads malicious scripts or binaries to the device filesystem and executes them with root privileges, enabling video footage theft, firmware modification for persistent backdoor installation, or using the compromised dashcam as a pivot point to attack other vehicle network components if connected.