CVE-2024-56897
📋 TL;DR
This vulnerability allows unauthenticated attackers to download/upload files and execute API commands on YI Car Dashcam devices. Attackers can disable recording, turn off sounds, factory reset devices, and potentially access sensitive footage. All users of affected YI Car Dashcam devices are at risk.
💻 Affected Systems
- YI Car Dashcam
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing attackers to disable security features, access private footage, upload malicious firmware, and render the dashcam useless.
Likely Case
Unauthorized access to recorded footage, disabling of recording functions, and potential privacy violations.
If Mitigated
Limited impact if network segmentation prevents external access and devices are behind firewalls.
🎯 Exploit Status
Simple HTTP requests can trigger the vulnerability. Proof-of-concept code is publicly available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://yitechnology.com.sg/products/dash-camera/
Restart Required: No
Instructions:
No official patch available. Contact YI Technology for firmware updates and check their website for security advisories.
🔧 Temporary Workarounds
Network Segmentation
allIsolate dashcam devices on a separate VLAN or network segment to prevent external access.
Firewall Rules
linuxBlock inbound connections to dashcam HTTP server (port 80) from untrusted networks.
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Disconnect dashcam from internet/Wi-Fi and use only local storage
- Physically disconnect device when not in use or park in secure locations
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[dashcam-ip]/api/status without authentication. If it returns device information, the device is vulnerable.Check Version:
Check device settings menu or access http://[dashcam-ip]/api/status for firmware versionVerify Fix Applied:
Check if authentication is now required for API endpoints and file access. Attempt unauthenticated access should fail.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to /api/ endpoints
- Multiple failed authentication attempts if logging enabled
- File download/upload activity
Network Indicators:
- HTTP requests to dashcam port 80 from external IPs
- Unusual API command patterns
- File transfer activity to/from dashcam
SIEM Query:
source_ip=external AND dest_port=80 AND (uri_path CONTAINS "/api/" OR uri_path CONTAINS "/download/")