70Mai
Monthly
A vulnerability was found in 70mai X200 up to 20251019. Rated high severity (CVSS 7.1). Public exploit code available and no vendor patch available.
Use of default credentials in the 70mai X200 dashcam HTTP web server allows remote unauthenticated attackers to access the device with root privileges. All firmware versions up to 20251010 are affected, and a publicly available exploit exists. The vendor was contacted but did not respond, and no official patch is available.
Authentication bypass in 70mai X200 dashcam firmware up to version 20251010 allows remote attackers to pair with the device without any authentication. The flaw resides in the Pairing component and can be exploited without user interaction or privileges. A publicly available exploit exists on GitHub, but the vendor has not responded to disclosure, leaving devices vulnerable with no official patch.
Denial of service in 70mai M300 dashcam firmware up to 20250611 allows an attacker on the local network to crash the device via the Telnet service's demo.sh script. A public exploit exists, but exploitation requires local network access and high attack complexity. No active exploitation in CISA KEV.
Remote code execution via default Telnet credentials in 70mai M300 dashcam firmware (versions up to 20250611) allows adjacent network attackers to gain full device control without authentication. The vulnerability has public exploit code available on GitHub demonstrating malicious file upload and code execution capabilities. Despite CVSS 7.4 severity and public exploitation techniques, EPSS probability remains low at 0.18% (40th percentile), suggesting limited widespread targeting of consumer dashcam devices, though adjacent network requirement (AV:A) makes this exploitable in shared WiFi environments or vehicle networks.
Improper authentication in 70mai M300 dashcam firmware up to 20250611 allows local network attackers to access the RTSP live video stream without credentials. A public exploit exists, but no active exploitation has been confirmed and EPSS risk is low.
A security vulnerability in 70mai M300 (CVSS 3.1). Risk factors: public PoC available.
Exposed root password via unauthenticated HTTP server in 70mai M300 dashcam firmware up to 20250611 allows local network attackers to obtain credentials. Public exploit code exists, but exploitation is difficult and requires local network access. No active exploitation in CISA KEV.
Critical authentication bypass vulnerability in the 70mai A510 dashcam that exploits default credentials in the device's user account configuration. Network-adjacent attackers can bypass authentication without any credentials and achieve remote code execution with root privileges. This vulnerability presents an immediate and severe risk due to its low attack complexity, lack of user interaction requirement, and the widespread deployment of 70mai dashcams in vehicles.
Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other protocols. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in 70mai X200 up to 20251019. Rated high severity (CVSS 7.1). Public exploit code available and no vendor patch available.
Use of default credentials in the 70mai X200 dashcam HTTP web server allows remote unauthenticated attackers to access the device with root privileges. All firmware versions up to 20251010 are affected, and a publicly available exploit exists. The vendor was contacted but did not respond, and no official patch is available.
Authentication bypass in 70mai X200 dashcam firmware up to version 20251010 allows remote attackers to pair with the device without any authentication. The flaw resides in the Pairing component and can be exploited without user interaction or privileges. A publicly available exploit exists on GitHub, but the vendor has not responded to disclosure, leaving devices vulnerable with no official patch.
Denial of service in 70mai M300 dashcam firmware up to 20250611 allows an attacker on the local network to crash the device via the Telnet service's demo.sh script. A public exploit exists, but exploitation requires local network access and high attack complexity. No active exploitation in CISA KEV.
Remote code execution via default Telnet credentials in 70mai M300 dashcam firmware (versions up to 20250611) allows adjacent network attackers to gain full device control without authentication. The vulnerability has public exploit code available on GitHub demonstrating malicious file upload and code execution capabilities. Despite CVSS 7.4 severity and public exploitation techniques, EPSS probability remains low at 0.18% (40th percentile), suggesting limited widespread targeting of consumer dashcam devices, though adjacent network requirement (AV:A) makes this exploitable in shared WiFi environments or vehicle networks.
Improper authentication in 70mai M300 dashcam firmware up to 20250611 allows local network attackers to access the RTSP live video stream without credentials. A public exploit exists, but no active exploitation has been confirmed and EPSS risk is low.
A security vulnerability in 70mai M300 (CVSS 3.1). Risk factors: public PoC available.
Exposed root password via unauthenticated HTTP server in 70mai M300 dashcam firmware up to 20250611 allows local network attackers to obtain credentials. Public exploit code exists, but exploitation is difficult and requires local network access. No active exploitation in CISA KEV.
Critical authentication bypass vulnerability in the 70mai A510 dashcam that exploits default credentials in the device's user account configuration. Network-adjacent attackers can bypass authentication without any credentials and achieve remote code execution with root privileges. This vulnerability presents an immediate and severe risk due to its low attack complexity, lack of user interaction requirement, and the widespread deployment of 70mai dashcams in vehicles.
Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other protocols. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.