CVE-2023-43271

Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other…

published October 9, 2023

CVSS
—
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

🚨 A misstep in the access controls of the 70mai a500s driving recorder makes it alarmingly easy for attackers to hop in and delete your precious driving footage! Think of it like leaving your car unlocked with the engine running — any passerby could hop in and erase your entire trip log without a second thought! 🔑 This could lead to a complete loss of critical video evidence from your journeys, potentially leaving you vulnerable in accidents or disputes. Imagine the frustration of losing those vital moments, just because someone exploited a simple oversight!

Put simply

Think of it like leaving your car unlocked with the engine running — any passerby could hop in and erase your entire trip log without a second thought! 🔑 The vulnerability stems from incorrect access control in version 1.2.119 of the 70mai a500s, allowing unauthorized users to access and delete video files via FTP and similar protocols, posing a significant risk to data integrity.

What to do

This could lead to a complete loss of critical video evidence from your journeys, potentially leaving you vulnerable in accidents or disputes. Imagine the frustration of losing those vital moments, just because someone exploited a simple oversight! To safeguard your recordings, update your device to the latest firmware version as soon as it's available. In the meantime, disable any unnecessary FTP access and review your device's security settings for proper access controls. 🛡️ You've got this! With a little attention, you can protect your driving data from unwanted deletion! 🚗💪

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00711 · 53.0th percentile
Published
2023-10-09T00:00Z
EPSS history
Timeline
  • 09 OCT 00:00Z
    Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other…
    cvelistv5