CVE-2025-7075
📋 TL;DR
CVE-2025-7075 is a critical vulnerability in BlackVue Dashcam 590X devices that allows unauthenticated attackers on the local network to upload arbitrary files to the device via the /upload.cgi HTTP endpoint. This could lead to remote code execution, device compromise, or data manipulation. Only BlackVue Dashcam 590X users with devices exposed on local networks are affected.
💻 Affected Systems
- BlackVue Dashcam 590X
📦 What is this software?
Blackvue Dr590x Firmware by Blackvuenorthamerica
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to remote code execution, data exfiltration, or use as a pivot point into the local network.
Likely Case
Malicious file upload leading to device compromise, data corruption, or unauthorized access to dashcam footage.
If Mitigated
Limited impact if proper network segmentation and access controls prevent local network access to the device.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Attack requires local network access but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Monitor BlackVue website for firmware updates addressing CVE-2025-7075.
🔧 Temporary Workarounds
Network Segmentation
allIsolate BlackVue dashcams on separate VLAN or network segment to prevent local network access.
Firewall Rules
allBlock access to dashcam HTTP ports (typically 80/443) from all devices except authorized management systems.
🧯 If You Can't Patch
- Disconnect dashcam from network when not actively transferring files
- Implement strict network access controls to limit which devices can communicate with the dashcam
🔍 How to Verify
Check if Vulnerable:
Check firmware version in BlackVue app or web interface. If version is 20250624 or earlier, device is vulnerable.Check Version:
Connect to dashcam web interface at http://[dashcam-ip] and check firmware version in settings.Verify Fix Applied:
Check for firmware updates in BlackVue app and verify version is newer than 20250624.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /upload.cgi endpoint
- Multiple failed or successful upload attempts from unauthorized IPs
Network Indicators:
- HTTP POST requests to /upload.cgi from unexpected sources
- Unusual outbound traffic from dashcam after exploitation
SIEM Query:
source_ip="*" AND dest_port=80 AND http_uri="/upload.cgi" AND http_method="POST"🔗 References
- https://github.com/geo-chen/BlackVue/blob/main/README.md#finding-1-unauthenticated-upload-endpoint-on-http
- https://vuldb.com/?ctiid.314989
- https://vuldb.com/?id.314989
- https://vuldb.com/?submit.603301
- https://github.com/geo-chen/BlackVue/blob/main/README.md#finding-1-unauthenticated-upload-endpoint-on-http
