EUVD-2025-18960Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker on local network
-
ExploitSend RTSP DESCRIBE request to /livestream/12
-
ExecutionReceive unauthorized video stream
-
ImpactView live footage
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be on the same local network as the dashcam (AV:A). No authentication is required (PR:N). The RTSP live video stream endpoint must be enabled (default configuration). No user interaction needed (UI:N). The vulnerability is limited to viewing the stream; no modification or denial of service. |
| Impact | CVSS 4.0 base score is 2.1 (Low) with vector AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, indicating low impact (only low confidentiality). EPSS score is 0.08% (percentile 22%), suggesting low exploitation probability. No KEV listing. Public POC exists but no active exploitation confirmed. SSVC: exploitation status 'none', automatable 'yes', technical impact 'partial'. Overall risk is low; the vulnerability allows viewing the live stream but not modification or disruption. |
| Exploit ScenarioDerived | An attacker on the same local network as the 70mai M300 dashcam sends a crafted RTSP request to /livestream/12 without authentication. The dashcam responds with the live video stream, allowing the attacker to view the camera feed. A public POC is available on GitHub. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Improper authentication in 70mai M300 dashcam firmware up to 20250611 allows local network attackers to access the RTSP live video stream without credentials. A public exploit exists, but no active exploitation has been confirmed and EPSS risk is low.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch identified at time of analysis. As a workaround, restrict network access to the dashcam's RTSP port (typically 554) to trusted devices only, e.g., by using a firewall or VLAN segmentation. Note that this may block legitimate remote viewing. Alternatively, disable the RTSP streaming feature if not needed. Monitor for future firmware updates from 70mai.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the RTSP (Real-Time Streaming Protocol) live video stream endpoint at /livestream/12 on 70mai M300 dashcams. RTSP is a network control protocol used for streaming media. The CWE-287 (Improper Authentication) indicates the endpoint fails to verify the identity of the requester, allowing unauthorized access. The CPE cpe:2.3:o:70mai:m300_firmware:*:*:*:*:*:*:*:* confirms the affected product is the firmware of the M300 dashcam.
Know when M300 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
AV:A due to local network requirement; PR:N; impact only low confidentiality.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in 70mai M300 up to 20250611 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /livestream/12 of the component RTSP Live Video Stream Endpoint. The manipulation leads to improper authentication. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Organizations using 70mai M300 should be aware of moderate risk from CVE-2025-6528, a improper authentication vulnerability rated CVSS 4.3. This could allow unauthorized access to protected resources. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access, enable MFA, monitor auth logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in M300 Firmware
View allRemote code execution via default Telnet credentials in 70mai M300 dashcam firmware (versions up to 20250611) allows adj
Denial of service in 70mai M300 dashcam firmware up to 20250611 allows an attacker on the local network to crash the dev
A security vulnerability in 70mai M300 (CVSS 3.1). Risk factors: public PoC available.
Exposed root password via unauthenticated HTTP server in 70mai M300 dashcam firmware up to 20250611 allows local network
Exploit-DB