Product: Dashcam
Version: 1S
Product URL: https://www.70mai.com/cam1s
From the official 70mai mobile app, a user needs to perform authorization by clicking on the physical power button in order to connect to the dashcam’s network. However, by connecting to the dashcam’s network and directly accessing the API on port 80 and RTSP on port 554, an attacker can bypass the device authorization mechanism that requires a user to physically press on the power button during connection.
This is the intended flow:
70mai-2.mp4
This is the bypass:
70mai-1.mov
Finding 2 - CVE-2025-6524: Unauthenticated File Storage Allowing Remote Dumping of Video Footage and Live Video Stream
Description: Once connected to the network of 70mai Dashcam 1S, all video recordings can be dumped via http://192.72.1.1/SD/Normal/$FILE_NAME without any http-level authentication:
http://192.72.1.1/SD/Normal/$FILE_NAME
The RTSP feed can also be accessed directly at port 554 - rtsp://192.72.1.1/liveRTSP/av4:
rtsp://192.72.1.1/liveRTSP/av4
Vulnerability Type: Incorrect Access Control
Vendor of Product: 70mai
Affected Product Code Base: Dash Cam 1S
Affected Component: Unauthenticated Video Services
Attack Type: Remote
Impact Code execution: False
Impact Information Disclosure: True
Attack Vectors: A remote attacker nearby can connect to the dashcam to view livestream or dump recorded sensitive media files.
Has vendor confirmed or acknowledged the vulnerability?: No
Description: Once connected to the network of 70mai Dashcam 1S, an attacker can make unauthorised configuration changes to the dashcam and even sabotage the car battery to drain it by disabling the battery protection settings:
curl -s "http://192.72.1.1/cgi-bin/Config.cgi?action=set&property=Camera.Menu.<REDACTED>
Vulnerability Type: Incorrect Access Control
Vendor of Product: 70mai
Affected Product Code Base: Dash Cam 1S
Affected Component: Unauthenticated Configuration Management
Attack Type: Remote
Impact Code execution: False
Impact Information Disclosure: True
Attack Vectors: A remote attacker nearby connected to the dashcam can make unauthorised changes to the dashcam's configurations without alerting the dashcam owner or pressing any physical pairing button on the dashcam.
Has vendor confirmed or acknowledged the vulnerability?: No
Product: Dashcam
Version: M300
Product URL: https://www.70mai.com/m300
Description: The 70mai Dashcam M300 has port 80 open without authentication such that an attacker connecting to the dashcam's network via default credentials, without needing device-pairing, can access all files on it.
From the web server, we obtain the root password hash and derive that it's using an empty password.
Vulnerability Type: Incorrect Access Control
Vendor of Product: 70mai
Affected Product Code Base: Dash Cam M300
Affected Component: Unauthenticated Web Server
Attack Type: Remote
Impact Code execution: False
Impact Information Disclosure: True
Attack Vectors: A remote attacker nearby connected to the dashcam's network can access all files on the web server without going through authentication or device pairing and can obtain the root password.
Has vendor confirmed or acknowledged the vulnerability?: No
Description: The 70mai Dashcam M300 has port 23 open with weak authentication such that an attacker connecting to the dashcam's network via default credentials, without needing device-pairing, can obtain a full list of video recordings and dump them out.
Although directory listing is disabled on the web server for the video recordings stored on SD card to prevent unauthorised personnel from downloading the videos:
There a a full bypass by obtaining the video recordings via telnet instead:
Then downloading them via curl or http:
Vulnerability Type: Incorrect Access Control
Vendor of Product: 70mai
Affected Product Code Base: Dash Cam M300
Affected Component: Weak Telnet Authentication
Attack Type: Remote
Impact Code execution: True
Impact Information Disclosure: True
Attack Vectors: A remote attacker nearby connected to the dashcam's network can access the dashcam's telnet session as root user and fetch a full list of sensitive video recordings.
Has vendor confirmed or acknowledged the vulnerability?: No
Description: Once connected to the network of 70mai Dashcam M300, an attacker can remotely access the live stream of the dashcam without authentication using the rtsp port:
rtsp://192.168.0.1:554/livestream/12
Vulnerability Type: Incorrect Access Control
Vendor of Product: 70mai
Affected Product Code Base: Dash Cam M300
Affected Component: Unauthenticated Video Services
Attack Type: Remote
Impact Code execution: False
Impact Information Disclosure: True
Attack Vectors: A remote attacker nearby can connect to the dashcam to view livestream without the dashcam owner's knowledge (no voice guidance or sounds triggered).
Has vendor confirmed or acknowledged the vulnerability?: No
Description: The 70mai Dashcam M300 has port 23 open with weak authentication such that an attacker connecting to the dashcam's network via default credentials, without needing device-pairing, can upload arbitrary/malicious files or even replace firmware via editing the auto-run script(s).
Vulnerability Type: Incorrect Access Control
Vendor of Product: 70mai
Affected Product Code Base: Dash Cam M300
Affected Component: OS Write Permissions
Attack Type: Remote
Impact Code execution: True
Impact Information Disclosure: True
Attack Vectors: A remote attacker nearby connected to the dashcam's network can write arbitrary code into the dashcam memory or SD, run malicious commands (RCE), or even replace the firmware with a malicious one.
Has vendor confirmed or acknowledged the vulnerability?: No
Description: If telnet is accessed on the 70mai Dashcam M300, a default script (demo.sh) is run automatically. In order to interact with the telnet session, the user needs to break the running of the script:
If not, the dashcam would continue running the default script, which is unintended, and that causes a natural crash and the dashcam light turns from green to blinking blue, then red, effectively stuck at a disabled state until the battery power drains out and it reboots.
This creates a DoS on the dashcam. Yes, this dashcam has a weak network stack.
Vulnerability Type: Incorrect Access Control
Vendor of Product: 70mai
Affected Product Code Base: Dash Cam M300
Affected Component: OS
Attack Type: Remote
Impact Code execution: True
Impact Information Disclosure: True
Attack Vectors: A remote attacker nearby can connect to the dashcam's telnet session to crash the camera and disable it.
Has vendor confirmed or acknowledged the vulnerability?: No
Product: Dashcam
Version: Omni X200
Product URL: https://www.70mai.com/global/omni/
Description: From the official 70mai mobile app, a user needs to perform authorization by clicking on the physical power button in order to connect to the dashcam’s network. However, by connecting to the dashcam’s network and directly accessing the API on port 80 and RTSP on port 554, an attacker can bypass the device authorization mechanism that requires a user to physically press on the power button during connection. Moreover, the http and rtsp services are not protected by any form of authentication.
Vulnerability Type: Incorrect Access Control
Vendor of Product: 70mai
Affected Product Code Base: Dash Cam Omni X200
Affected Component: Authentication mechanism
Attack Type: Remote
Impact Code execution: False
Impact Information Disclosure: True
Attack Vectors: A remote attacker nearby can connect to the dashcam's services without needing to physically pair the device.
Has vendor confirmed or acknowledged the vulnerability?: No
Description: The 70mai Dashcam Omni X200 has port 80 open without authentication such that an attacker connecting to the dashcam's network via default credentials can access all files on it.
Even if the OS's password is changed, it would still be exposed by the http server.
Vulnerability Type: Incorrect Access Control
Vendor of Product: 70mai
Affected Product Code Base: Dash Cam Omni X200
Affected Component: Unauthenticated Web Server
Attack Type: Remote
Impact Code execution: False
Impact Information Disclosure: True
Attack Vectors: A remote attacker nearby connected to the dashcam's network can access all files on the web server without going through authentication or device pairing and can obtain the root password.
Has vendor confirmed or acknowledged the vulnerability?: No
Finding 11 - CVE-2025-12915: Init Script Binary Hijack Persistence Vulnerability in 70mai X200 Omni Dashcam
Description: The 70mai X200 Omni dashcam is vulnerable to a persistence attack where an init script calls a missing binary, allowing an attacker to place a malicious binary at that path. This binary executes automatically at boot, enabling persistent code execution. This aligns with MITRE ATT&CK techniques T1037.004 (RC Scripts persistence) and T1554 (Hijack Execution Flow via binary replacement). The flaw allows stealthy, persistent control over the device, compromising its integrity and security. Proper binary validation and script hardening are essential to mitigate this risk.
Credits: Tan Chee Peng
Vulnerability Type: Incorrect Access Control / Persistence via Binary Hijacking
Vendor of Product: 70mai
Affected Product Code Base: Dash Cam Omni X200
Affected Component: Initialization Script
Attack Type: Local
Impact Code execution: True
Impact Information Disclosure: True
Attack Vectors: An attacker with access to the device’s network or filesystem can place a malicious binary at a path referenced by the boot initialization script (which normally points to a missing binary). This causes the malicious binary to run automatically on device boot, achieving persistent code execution and potentially exposing sensitive information or system control.
Has vendor confirmed or acknowledged the vulnerability?: No
31 Jan 2025 - Responsible disclosure to manufacturer
15 Feb 2025 - A follow-up email to manufacturer