M300 Firmware
Monthly
Denial of service in 70mai M300 dashcam firmware up to 20250611 allows an attacker on the local network to crash the device via the Telnet service's demo.sh script. A public exploit exists, but exploitation requires local network access and high attack complexity. No active exploitation in CISA KEV.
Remote code execution via default Telnet credentials in 70mai M300 dashcam firmware (versions up to 20250611) allows adjacent network attackers to gain full device control without authentication. The vulnerability has public exploit code available on GitHub demonstrating malicious file upload and code execution capabilities. Despite CVSS 7.4 severity and public exploitation techniques, EPSS probability remains low at 0.18% (40th percentile), suggesting limited widespread targeting of consumer dashcam devices, though adjacent network requirement (AV:A) makes this exploitable in shared WiFi environments or vehicle networks.
Improper authentication in 70mai M300 dashcam firmware up to 20250611 allows local network attackers to access the RTSP live video stream without credentials. A public exploit exists, but no active exploitation has been confirmed and EPSS risk is low.
A security vulnerability in 70mai M300 (CVSS 3.1). Risk factors: public PoC available.
Exposed root password via unauthenticated HTTP server in 70mai M300 dashcam firmware up to 20250611 allows local network attackers to obtain credentials. Public exploit code exists, but exploitation is difficult and requires local network access. No active exploitation in CISA KEV.
Denial of service in 70mai M300 dashcam firmware up to 20250611 allows an attacker on the local network to crash the device via the Telnet service's demo.sh script. A public exploit exists, but exploitation requires local network access and high attack complexity. No active exploitation in CISA KEV.
Remote code execution via default Telnet credentials in 70mai M300 dashcam firmware (versions up to 20250611) allows adjacent network attackers to gain full device control without authentication. The vulnerability has public exploit code available on GitHub demonstrating malicious file upload and code execution capabilities. Despite CVSS 7.4 severity and public exploitation techniques, EPSS probability remains low at 0.18% (40th percentile), suggesting limited widespread targeting of consumer dashcam devices, though adjacent network requirement (AV:A) makes this exploitable in shared WiFi environments or vehicle networks.
Improper authentication in 70mai M300 dashcam firmware up to 20250611 allows local network attackers to access the RTSP live video stream without credentials. A public exploit exists, but no active exploitation has been confirmed and EPSS risk is low.
A security vulnerability in 70mai M300 (CVSS 3.1). Risk factors: public PoC available.
Exposed root password via unauthenticated HTTP server in 70mai M300 dashcam firmware up to 20250611 allows local network attackers to obtain credentials. Public exploit code exists, but exploitation is difficult and requires local network access. No active exploitation in CISA KEV.