BlackVue - Revision history

Sojourna: Clean-up; pass on style.

2026-04-20T05:12:12Z

Clean-up; pass on style.

Louis: fixed cve-2355/2356 conflation, 2.2k ratings not 2197, removed unsourced seoul, trimmed unsourced inference

2026-03-29T04:20:32Z

fixed cve-2355/2356 conflation, 2.2k ratings not 2197, removed unsourced seoul, trimmed unsourced inference

Louis: rewrote from stub. added gps tracking incident (2018-2024, vice/cybernews), firmware cves (dr750 & dr590x), mandatory registration history, cloud tier removal. fixed company type to private, sourced everything.

2026-03-29T04:13:24Z

rewrote from stub. added gps tracking incident (2018-2024, vice/cybernews), firmware cves (dr750 & dr590x), mandatory registration history, cloud tier removal. fixed company type to private, sourced everything.

Show changes

Banana: Added archive URLs for 2 citation(s) using CRWCitationBot

2026-02-16T01:15:17Z

Added archive URLs for 2 citation(s) using CRWCitationBot

← Older revision		Revision as of 01:15, 16 February 2026
Line 18:		Line 18:
	==Incidents==		==Incidents==
	===Require Registration to Use Cameras (''March 13, 2025'')===		===Require Registration to Use Cameras (''March 13, 2025'')===
	On March 13, 2025 BlackVue published a blog post<ref>{{Cite web \|title=Discover the Latest BlackVue App Update: Enhanced UI, New Features, and More \|url=https://media.blackvue.com/discover-the-latest-blackvue-app-update-enhanced-ui-new-features-and-more/}}</ref> announcing that accounts, comprised of email and password registered with BlackVue, will be required to use the app. The app is required to perform firmware upgrades on the camera, as well as transfer videos without removing the SD card.		On March 13, 2025 BlackVue published a blog post<ref>{{Cite web \|title=Discover the Latest BlackVue App Update: Enhanced UI, New Features, and More \|url=https://media.blackvue.com/discover-the-latest-blackvue-app-update-enhanced-ui-new-features-and-more/ \|url-status=live \|archive-url=http://web.archive.org/web/20250911215829/https://media.blackvue.com/discover-the-latest-blackvue-app-update-enhanced-ui-new-features-and-more/ \|archive-date=11 Sep 2025}}</ref> announcing that accounts, comprised of email and password registered with BlackVue, will be required to use the app. The app is required to perform firmware upgrades on the camera, as well as transfer videos without removing the SD card.

	Last version of the Android app not requiring this is 3.65, version code 36500. Version 3.66 and up now requires registration.		Last version of the Android app not requiring this is 3.65, version code 36500. Version 3.66 and up now requires registration.

	The app itself is reported to contain 6 trackers, and requiring 43 permissions including fine permission as analyzed by Exodus Privacy<ref>{{Cite web \|title=Exodus Privacy Analysis \|url=https://reports.exodus-privacy.eu.org/en/reports/comb.blackvuec/latest/}}</ref>		The app itself is reported to contain 6 trackers, and requiring 43 permissions including fine permission as analyzed by Exodus Privacy<ref>{{Cite web \|title=Exodus Privacy Analysis \|url=https://reports.exodus-privacy.eu.org/en/reports/comb.blackvuec/latest/ \|url-status=live \|archive-url=http://web.archive.org/web/20250728153313/https://reports.exodus-privacy.eu.org/en/reports/comb.blackvuec/latest/ \|archive-date=28 Jul 2025}}</ref>

	==Products==		==Products==

Bythmusters: Copied info from infobox to cargo

2026-01-25T15:25:49Z

Copied info from infobox to cargo

← Older revision		Revision as of 15:25, 25 January 2026
Line 1:		Line 1:
	{{Incomplete}}		{{Incomplete}}
	{{~~InfoboxCompany~~		{{CompanyCargo
	\| ~~Name~~ = ~~{{PAGENAME}}~~		\|Description=
	~~\| Type =Public~~		\|Founded=2007
	\| Founded =2007		\|Industry=Electronics
	\| Industry =Electronics		\|Logo=
	\| ~~Official~~ Website =https://blackvue.com/		\|ParentCompany=
	~~\| Logo =QuestionMark.svg~~		\|Type=Public
	}}BlackVue is a dash camera brand owned by Pittasoft Co. Ltd.		\|Website=https://blackvue.com/
			}}
			BlackVue is a dash camera brand owned by Pittasoft Co. Ltd.

	==Consumer-impact summary==		==Consumer-impact summary==

185.92.29.200 at 10:17, 27 June 2025

2025-06-27T10:17:55Z

← Older revision		Revision as of 10:17, 27 June 2025
Line 16:		Line 16:
	==Incidents==		==Incidents==
	===Require Registration to Use Cameras (''March 13, 2025'')===		===Require Registration to Use Cameras (''March 13, 2025'')===
	On March 13, 2025 BlackVue published a blog post<ref>{{Cite web \|title=Discover the Latest BlackVue App Update: Enhanced UI, New Features, and More \|url=https://media.blackvue.com/discover-the-latest-blackvue-app-update-enhanced-ui-new-features-and-more/}}</ref> announcing that accounts, comprised of email and password registered with BlackVue, will be required to use the app. The app is required to perform firmware upgrades on the camera, as well as transfer videos without removing the ~~SDK~~ card.		On March 13, 2025 BlackVue published a blog post<ref>{{Cite web \|title=Discover the Latest BlackVue App Update: Enhanced UI, New Features, and More \|url=https://media.blackvue.com/discover-the-latest-blackvue-app-update-enhanced-ui-new-features-and-more/}}</ref> announcing that accounts, comprised of email and password registered with BlackVue, will be required to use the app. The app is required to perform firmware upgrades on the camera, as well as transfer videos without removing the SD card.

	Last version of the Android app not requiring this is 3.65, version code 36500. Version 3.66 and up now requires registration.		Last version of the Android app not requiring this is 3.65, version code 36500. Version 3.66 and up now requires registration.

NoGoodDeed: Fix typo

2025-06-24T03:27:48Z

Fix typo

← Older revision		Revision as of 03:27, 24 June 2025
Line 11:		Line 11:
	==Consumer-impact summary==		==Consumer-impact summary==

	* User Freedom		*User Freedom
	* User Privacy		*User Privacy

	==Incidents==		==Incidents==
	===Require Registration to Use Cameras (''March 13, 2025'')===		===Require Registration to Use Cameras (''March 13, 2025'')===
	On March 13, 2025 BlackVue published a blog post<ref>{{Cite web \|title=Discover the Latest BlackVue App Update: Enhanced UI, New Features, and More \|url=https://media.blackvue.com/discover-the-latest-blackvue-app-update-enhanced-ui-new-features-and-more/}}</ref> announcing that accounts, comprised of email and password registered with BlackVue, will be required to use the app. The app is required to to perform firmware upgrades on the camera, as well as transfer videos without removing the SDK card.		On March 13, 2025 BlackVue published a blog post<ref>{{Cite web \|title=Discover the Latest BlackVue App Update: Enhanced UI, New Features, and More \|url=https://media.blackvue.com/discover-the-latest-blackvue-app-update-enhanced-ui-new-features-and-more/}}</ref> announcing that accounts, comprised of email and password registered with BlackVue, will be required to use the app. The app is required to perform firmware upgrades on the camera, as well as transfer videos without removing the SDK card.

	Last version of the Android app not requiring this is 3.65, version code 36500. Version 3.66 and up now requires registration.		Last version of the Android app not requiring this is 3.65, version code 36500. Version 3.66 and up now requires registration.

173.206.120.62: /* Consumer-impact summary */

2025-06-24T02:00:50Z

Consumer-impact summary

← Older revision		Revision as of 02:00, 24 June 2025
Line 10:		Line 10:

	==Consumer-impact summary==		==Consumer-impact summary==
	~~{{Placeholder box\|Overview of concerns that arise from the conduct towards users of the product (if applicable):~~
	* User Freedom		* User Freedom
	* User Privacy		* User Privacy
	* Business Model
	* Market Control}}

	==Incidents==		==Incidents==

Mr Pollo at 01:35, 24 June 2025

2025-06-24T01:35:11Z

← Older revision		Revision as of 01:35, 24 June 2025
Line 1:		Line 1:
			{{Incomplete}}
	{{InfoboxCompany		{{InfoboxCompany
	\| Name = {{PAGENAME}}		\| Name = {{PAGENAME}}
Line 9:		Line 10:

	==Consumer-impact summary==		==Consumer-impact summary==
			{{Placeholder box\|Overview of concerns that arise from the conduct towards users of the product (if applicable):
	*User ~~freedoms~~		* User Freedom
	*User ~~privacy~~		* User Privacy
			* Business Model
			* Market Control}}

	==Incidents==		==Incidents==

173.206.120.62: Initial Entry

2025-06-24T00:41:27Z

Initial Entry

New page

{{InfoboxCompany
| Name = {{PAGENAME}}
| Type =Public
| Founded =2007
| Industry =Electronics
| Official Website =https://blackvue.com/
| Logo =QuestionMark.svg
}}BlackVue is a dash camera brand owned by Pittasoft Co. Ltd.

==Consumer-impact summary==

*User freedoms
*User privacy

==Incidents==
===Require Registration to Use Cameras (''March 13, 2025'')===
On March 13, 2025 BlackVue published a blog post<ref>{{Cite web |title=Discover the Latest BlackVue App Update: Enhanced UI, New Features, and More |url=https://media.blackvue.com/discover-the-latest-blackvue-app-update-enhanced-ui-new-features-and-more/}}</ref> announcing that accounts, comprised of email and password registered with BlackVue, will be required to use the app. The app is required to to perform firmware upgrades on the camera, as well as transfer videos without removing the SDK card.

Last version of the Android app not requiring this is 3.65, version code 36500. Version 3.66 and up now requires registration.

The app itself is reported to contain 6 trackers, and requiring 43 permissions including fine permission as analyzed by Exodus Privacy<ref>{{Cite web |title=Exodus Privacy Analysis |url=https://reports.exodus-privacy.eu.org/en/reports/comb.blackvuec/latest/}}</ref>

==Products==

*DR770X

==References==
{{reflist}}

[[Category:{{PAGENAME}}]]

← Older revision		Revision as of 04:20, 29 March 2026
Line 23:		Line 23:
	== Background ==		== Background ==

	Pittasoft Co. Ltd. was founded on July 2, 2007, in ~~Seoul,~~ South Korea, by Hyunmin Hur.<ref name="tracxn" /><ref name="bv-sg">{{Cite web \|title=About Us \|url=https://www.blackvue.com.sg/about-us.html \|website=BlackVue Singapore \|access-date=2026-03-28}}</ref> The company initially focused on IP CCTV solutions before pivoting to dashboard cameras. The BlackVue brand launched in 2010 with the DR300, the company's first dashcam.<ref name="bv-sg" /> In 2015, Pittasoft introduced BlackVue Over the Cloud, a connected service that allows remote live viewing, GPS tracking, & push notifications through an internet-connected dashcam.<ref name="bv-sg" />		Pittasoft Co. Ltd. was founded on July 2, 2007, in South Korea, by Hyunmin Hur.<ref name="tracxn" /><ref name="bv-sg">{{Cite web \|title=About Us \|url=https://www.blackvue.com.sg/about-us.html \|website=BlackVue Singapore \|access-date=2026-03-28}}</ref> The company initially focused on IP CCTV solutions before pivoting to dashboard cameras. The BlackVue brand launched in 2010 with the DR300, the company's first dashcam.<ref name="bv-sg" /> In 2015, Pittasoft introduced BlackVue Over the Cloud, a connected service that allows remote live viewing, GPS tracking, & push notifications through an internet-connected dashcam.<ref name="bv-sg" />

	Pittasoft manufactures its dashcams in South Korea.<ref name="bv-sg" /> The company is privately held & has not raised institutional funding or executed an IPO.<ref name="tracxn" />		Pittasoft manufactures its dashcams in South Korea.<ref name="bv-sg" /> The company is privately held & has not raised institutional funding or executed an IPO.<ref name="tracxn" />
Line 36:		Line 36:
	Vice journalist Joseph Cox investigated further in January 2020, reverse-engineering the BlackVue iOS app & wrote scripts that collected the GPS locations of every BlackVue user with mapping enabled on the eastern half of the United States every two minutes over a week-long period.<ref name="vice">{{Cite web \|title=This App Lets Us See Everywhere People Drive \|url=https://www.vice.com/en/article/blackvue-dashcams-users-location-tracked/ \|website=Vice/Motherboard \|first=Joseph \|last=Cox \|date=2020-01-16 \|access-date=2026-03-28}}</ref> The researchers tracked users in Manhattan, Brooklyn, Queens, South Carolina, Hong Kong, China, Russia, the UK, & Germany. A BlackVue spokesperson told Vice that collecting multiple users' GPS coordinates over extended periods "is not supposed to be possible" & claimed the company had updated security measures.<ref name="vice" />		Vice journalist Joseph Cox investigated further in January 2020, reverse-engineering the BlackVue iOS app & wrote scripts that collected the GPS locations of every BlackVue user with mapping enabled on the eastern half of the United States every two minutes over a week-long period.<ref name="vice">{{Cite web \|title=This App Lets Us See Everywhere People Drive \|url=https://www.vice.com/en/article/blackvue-dashcams-users-location-tracked/ \|website=Vice/Motherboard \|first=Joseph \|last=Cox \|date=2020-01-16 \|access-date=2026-03-28}}</ref> The researchers tracked users in Manhattan, Brooklyn, Queens, South Carolina, Hong Kong, China, Russia, the UK, & Germany. A BlackVue spokesperson told Vice that collecting multiple users' GPS coordinates over extended periods "is not supposed to be possible" & claimed the company had updated security measures.<ref name="vice" />

	The issue resurfaced in January 2022 when cybersecurity researcher Andy Gill reported the same problem to CyberNews. By downloading the free BlackVue app & registering an account (which required no email verification), anyone could view the GPS locations & live video feeds of connected dashcams.<ref name="cybernews" /> BlackVue responded that sharing is "opt-in only" & claimed all cameras are set to private by default, but Gill's testing showed GPS access was enabled by default.<ref name="cybernews" /> BlackVue acknowledged that "some information might be misleading" & said it would change the wording ~~but made no changes to the functionality~~.<ref name="cybernews" />		The issue resurfaced in January 2022 when cybersecurity researcher Andy Gill reported the same problem to CyberNews. By downloading the free BlackVue app & registering an account (which required no email verification), anyone could view the GPS locations & live video feeds of connected dashcams.<ref name="cybernews" /> BlackVue responded that sharing is "opt-in only" & claimed all cameras are set to private by default, but Gill's testing showed GPS access was enabled by default.<ref name="cybernews" /> BlackVue acknowledged that "some information might be misleading" & said it would change the wording.<ref name="cybernews" />

	Gill published his findings in March 2024, two years after originally discovering the issue, because BlackVue had not made any changes. His post included an email exchange with BlackVue UK, in which a representative called the public broadcasting of location, video, & audio "a case of personal choice" & described it as "a mature [feature], having been available for nearly 5 years."<ref name="zsec">{{Cite web \|title=BlackVue Dashcams - It's not a bug, it is a feature \|url=https://blog.zsec.uk/blackvue-privacy/ \|website=ZephrSec \|first=Andy \|last=Gill \|date=2024-03-15 \|access-date=2026-03-28}}</ref>		Gill published his findings in March 2024, two years after originally discovering the issue, because BlackVue had not made any changes. His post included an email exchange with BlackVue UK, in which a representative called the public broadcasting of location, video, & audio "a case of personal choice" & described it as "a mature [feature], having been available for nearly 5 years."<ref name="zsec">{{Cite web \|title=BlackVue Dashcams - It's not a bug, it is a feature \|url=https://blog.zsec.uk/blackvue-privacy/ \|website=ZephrSec \|first=Andy \|last=Gill \|date=2024-03-15 \|access-date=2026-03-28}}</ref>
Line 58:		Line 58:
	* '''CVE-2025-7075''' (CVSS 8.8 High): An unauthenticated /upload.cgi endpoint allows arbitrary file uploads, including malicious code, when connected to the dashcam's network.<ref name="cve-7075">{{Cite web \|title=CVE-2025-7075 Detail \|url=https://nvd.nist.gov/vuln/detail/CVE-2025-7075 \|website=National Vulnerability Database \|date=2025-07-05 \|access-date=2026-03-28}}</ref>		* '''CVE-2025-7075''' (CVSS 8.8 High): An unauthenticated /upload.cgi endpoint allows arbitrary file uploads, including malicious code, when connected to the dashcam's network.<ref name="cve-7075">{{Cite web \|title=CVE-2025-7075 Detail \|url=https://nvd.nist.gov/vuln/detail/CVE-2025-7075 \|website=National Vulnerability Database \|date=2025-07-05 \|access-date=2026-03-28}}</ref>
	* '''CVE-2025-7076''': The same upload mechanism allows modification of device configurations, including the ability to disable battery protection & drain the vehicle's battery.<ref name="cve25-github" />		* '''CVE-2025-7076''': The same upload mechanism allows modification of device configurations, including the ability to disable battery protection & drain the vehicle's battery.<ref name="cve25-github" />
	* '''CVE-2025-2355''': The BlackVue v3.65 Android APK exposes both the BCS_TOKEN & SECRET_KEY in plaintext~~. API secrets are transmitted via GET parameters, exposing them in browser history & proxy logs~~.<ref name="cve25-github" />		* '''CVE-2025-2355''': The BlackVue v3.65 Android APK exposes both the BCS_TOKEN & SECRET_KEY in plaintext.<ref name="cve25-github" />
	* '''CVE-2025-2356''': Sensitive API endpoints allow unauthorized calls to change device settings, including deleting a device from an account.<ref name="cve25-github" />		* '''CVE-2025-2356''': Sensitive API endpoints transmit authentication tokens via GET parameters, exposing them in browser history, referral URLs, & proxy logs. The endpoints allow unauthorized calls to change device settings, including deleting a device from an account.<ref name="cve25-github" />

	=== Mandatory app registration ===		=== Mandatory app registration ===
Line 72:		Line 72:
	The Android app version 3.66 requests 43 permissions according to APKMirror, rising to 44 permissions in version 4.15.<ref name="apk-366" /> Pittasoft's privacy policy discloses the use of Meta Events Manager, HubSpot Analytics, & TikTok conversion tracking for advertising & analytics purposes.<ref name="privacy-policy">{{Cite web \|title=BlackVue Privacy Policy \|url=https://www.iubenda.com/privacy-policy/58407536/full-legal \|website=Iubenda \|date=2025-05-18 \|access-date=2026-03-28}}</ref>		The Android app version 3.66 requests 43 permissions according to APKMirror, rising to 44 permissions in version 4.15.<ref name="apk-366" /> Pittasoft's privacy policy discloses the use of Meta Events Manager, HubSpot Analytics, & TikTok conversion tracking for advertising & analytics purposes.<ref name="privacy-policy">{{Cite web \|title=BlackVue Privacy Policy \|url=https://www.iubenda.com/privacy-policy/58407536/full-legal \|website=Iubenda \|date=2025-05-18 \|access-date=2026-03-28}}</ref>

	On the Apple App Store, the app holds a 3.8 out of 5 rating from 2,~~197 reviews~~. Users reported that "App worked just fine for years PRIOR to their requiring you to have an account" & that "NOBODY needs or wants an account" to view local videos on cameras they already own.<ref name="appstore">{{Cite web \|title=BlackVue on the App Store \|url=https://apps.apple.com/us/app/blackvue/id1049209637 \|website=Apple App Store \|access-date=2026-03-28}}</ref>		On the Apple App Store, the app holds a 3.8 out of 5 rating from approximately 2,200 ratings. Users reported that "App worked just fine for years PRIOR to their requiring you to have an account" & that "NOBODY needs or wants an account" to view local videos on cameras they already own.<ref name="appstore">{{Cite web \|title=BlackVue on the App Store \|url=https://apps.apple.com/us/app/blackvue/id1049209637 \|website=Apple App Store \|access-date=2026-03-28}}</ref>

	=== Cloud subscription tier removal ===		=== Cloud subscription tier removal ===