CVE-2023-27747
📋 TL;DR
BlackVue DR750-2CH LTE dash cameras running firmware version 1.012_2022.10.26 lack authentication on their web server interface. This allows attackers to access sensitive dashcam configurations and recorded footage without credentials. Anyone using this specific dashcam model with the vulnerable firmware is affected.
💻 Affected Systems
- BlackVue DR750-2CH LTE
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers remotely access all dashcam recordings, potentially obtaining sensitive location data, license plates, and personal information. They could also modify configurations to disable recording or exfiltrate data.
Likely Case
Unauthorized access to dashcam footage and configuration settings, potentially exposing driving patterns, locations, and vehicle information.
If Mitigated
With proper network segmentation and firewall rules, the dashcam is isolated from untrusted networks, limiting exposure to local attackers only.
🎯 Exploit Status
The vulnerability requires no authentication, making exploitation trivial. Public GitHub repositories demonstrate access techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://blackvue.com
Restart Required: No
Instructions:
Check BlackVue website for firmware updates. If available, download and install via the BlackVue mobile app or SD card method.
🔧 Temporary Workarounds
Network Segmentation
allIsolate the dashcam on a separate VLAN or network segment with no internet access
Firewall Rules
allBlock all external access to the dashcam's web interface (typically port 80/443)
🧯 If You Can't Patch
- Disable the dashcam's LTE connectivity if not needed
- Physically disconnect the dashcam when vehicle is parked for extended periods
🔍 How to Verify
Check if Vulnerable:
Access the dashcam's web interface via its IP address. If you can view configurations/recordings without authentication, it's vulnerable.Check Version:
Check firmware version in BlackVue mobile app under Settings > Firmware UpdateVerify Fix Applied:
After firmware update, attempt to access web interface without credentials - should receive authentication prompt or access denied.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to dashcam web interface
- Multiple failed authentication attempts if authentication is enabled
Network Indicators:
- External IP addresses accessing dashcam web interface
- Unusual traffic to dashcam port 80/443
SIEM Query:
source_ip=external AND dest_port=80 AND dest_ip=dashcam_ip🔗 References
- https://blackvue.com
- https://github.com/eyJhb/blackvue-cve-2022
- https://github.com/eyJhb/blackvue-cve-2023
- https://shop.blackvue.com/product/dr750-2ch-ir-lte/
- https://blackvue.com
- https://github.com/eyJhb/blackvue-cve-2022
- https://github.com/eyJhb/blackvue-cve-2023
- https://shop.blackvue.com/product/dr750-2ch-ir-lte/
