CVE-2024-56897

Published: Feb 24, 2025Modified: Mar 3, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands. API commands can also be made to make unauthorized modifications to the device settings, such as disabling recording, disabling sounds, factory reset.

Affected (1)

Products: Yitechnology: Yi Car Dashcam Firmware

1 product

Yi Car Dashcam Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yitechnology Yi Car Dashcam Firmware	Version 3.88

Running on/with	Platform Versions
Yitechnology Yi Car Dashcam	All versions

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (3)

https://geochen.medium.com/cve-2024-56897-yi-car-dashcam-39304a4b21b4

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/geo-chen/YI-Smart-Dashcam/

Source: cve@mitre.org

ExploitThird Party Advisory

https://yitechnology.com.sg/products/dash-camera/

Source: cve@mitre.org

Broken Link

Timeline

No history available yet.