CVE-2025-6529
📋 TL;DR
The 70mai M300 dash cam has a critical vulnerability where its Telnet service uses default credentials, allowing attackers on the same local network to gain unauthorized access. This can lead to remote code execution and full device compromise. Only 70mai M300 dash cams with firmware up to June 11, 2025 are affected.
💻 Affected Systems
- 70mai M300 dash cam
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control of the dash cam, execute arbitrary code, install malware, steal video footage, and potentially pivot to other network devices.
Likely Case
Unauthorized access to the dash cam's system, enabling data theft, device manipulation, and installation of persistent backdoors.
If Mitigated
Limited impact if network segmentation isolates the device and default credentials are changed.
🎯 Exploit Status
Exploit uses default credentials (username/password combination disclosed in public GitHub repository). Simple telnet connection with known credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to disclosure. Consider workarounds or replacement.
🔧 Temporary Workarounds
Disable Telnet Service
linuxPermanently disable the Telnet service on the dash cam to prevent credential-based attacks.
telnet 192.168.1.100
login with default credentials
systemctl disable telnet
systemctl stop telnet
Change Default Credentials
linuxModify the default Telnet credentials to prevent unauthorized access.
telnet 192.168.1.100
login with default credentials
passwd
set new strong password
🧯 If You Can't Patch
- Network segmentation: Isolate dash cam on separate VLAN with strict firewall rules
- Disable Telnet via physical reset if possible and use only required services
🔍 How to Verify
Check if Vulnerable:
Attempt telnet connection to dash cam IP on port 23 using default credentials from public exploit.Check Version:
Check device firmware version in settings menu or via telnet: cat /etc/versionVerify Fix Applied:
Verify Telnet service is disabled or credentials no longer work. Test with telnet connection attempts.📡 Detection & Monitoring
Log Indicators:
- Failed/successful Telnet authentication attempts
- Unexpected process execution from Telnet sessions
Network Indicators:
- Telnet connections to dash cam IP on port 23
- Unusual outbound connections from dash cam
SIEM Query:
source="dashcam" AND (event="telnet_login" OR port=23)