VulnerabilityModified

CVE-2024-56897

Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands.

CRITICAL 9.8EPSS 0.73%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.73%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands. API commands can also be made to make unauthorized modifications to the device settings, such as disabling recording, disabling sounds, factory reset.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.73% probability · 52th percentile
CISA KEV: Not listed
Weakness: CWE-434
Affected: yitechnology/yi car dashcam firmware
Source: cve@mitre.org

References

https://geochen.medium.com/cve-2024-56897-yi-car-dashcam-39304a4b21b4Exploit, Third Party Advisory
https://github.com/geo-chen/YI-Smart-Dashcam/Exploit, Third Party Advisory
https://yitechnology.com.sg/products/dash-camera/Broken Link

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.