BlackVue

BlackVue

Basic information
Founded	2007
Legal Structure	Private
Industry	Electronics, Automotive
Also known as	Pittasoft, Pittasoft Co. Ltd.
Official website	https://blackvue.com/

BlackVue is a dashcam brand manufactured by Pittasoft Co. Ltd., a privately held South Korean company founded in 2007. Since 2018, multiple independent security researchers have found that BlackVue's cloud service broadcasts users' real-time GPS locations, live video feeds, and audio to anyone with a free account. Seven CVEs across two product lines remain un-patched or were only acknowledged after public disclosure, and in April 2025 Pittasoft began requiring a BlackVue account to use the companion app, removing the ability to access a locally-connected dashcam without an internet login. In June 2026, Australian outlet Nine News found that BlackVue dashcams used in Australia were still broadcasting users' location, video, and audio by default, which BlackVue's Australian distributor dismissed as "sensationalist and inaccurate." Days later, after the distributor's own privacy-settings blog post was contradicted by further independent testing, it removed the live-broadcast feature from the app entirely.

Consumer impact summary

• User privacy: BlackVue Cloud has broadcast users' GPS coordinates, live video, and audio to anyone with a free app account since at least 2018. BlackVue called this "a feature, not a bug" in 2022 and dismissed Australian media reporting on the issue as "sensationalist and inaccurate" in 2026, before its Australian distributor removed the broadcast feature entirely.
• Device security: Seven CVEs (two CVSS 9.8 Critical, two CVSS 8.8 High, one CVSS 7.5 High) across the DR750 and DR590X product lines allow remote firmware backdooring, unauthenticated access to recordings, and hardcoded API secrets. The DR750 vulnerabilities reported in July 2022 remain unpatched.
• User freedom: Since April 2025, the BlackVue companion app requires a BlackVue account to access a locally-connected dashcam. Non-login Wi-Fi Mode was removed.
• Subscription lock-in: In early 2025, Pittasoft discontinued its "Free Forever" cloud tier and moved all cloud features to paid subscriptions, breaking a promise made to existing customers.

Background

Pittasoft Co. Ltd. was founded on 2 July 2007, in South Korea, by Hyunmin Hur. The company initially focused on IP CCTV solutions before pivoting to dashboard cameras. The BlackVue brand launched in 2010 with the DR300, the company's first dashcam. In 2015, Pittasoft introduced BlackVue Over the Cloud, a connected service that allows remote live viewing, GPS tracking, and push notifications through an internet-connected dashcam.

Pittasoft manufactures its dashcams in South Korea. The company is privately held and has not raised institutional funding or executed an IPO.

Incidents

This is a list of all consumer-protection incidents related to this product. Any incidents not mentioned here can be found in the BlackVue category.

GPS location broadcasting (2018—)

Main article: BlackVue GPS location broadcasting

In October 2018, CSO Online reported that BlackVue dashcam owners were unknowingly broadcasting their real-time GPS coordinates, live video, and audio through BlackVue Cloud. The default cloud configuration when enabling the service opted users into public sharing without warning.

Vice journalist Joseph Cox investigated further in January 2020, reverse-engineering the BlackVue iOS app and wrote scripts that collected the GPS locations of every BlackVue user with mapping enabled on the eastern half of the United States every two minutes over a week-long period. The researchers tracked users in Manhattan, Brooklyn, Queens, South Carolina, Hong Kong, China, Russia, the UK, and Germany. A BlackVue spokesperson told Vice that collecting multiple users' GPS coordinates over extended periods "is not supposed to be possible" and claimed the company had updated security measures.

The issue resurfaced in January 2022 when cybersecurity researcher Andy Gill reported the same problem to CyberNews. By downloading the free BlackVue app and registering an account (which required no e-mail verification), anyone could view the GPS locations and live-video feeds of connected dashcams. BlackVue responded that sharing is "opt-in only" and claimed all cameras are set to private by default, but Gill's testing showed GPS access was enabled by default. BlackVue acknowledged that "some information might be misleading" and said it would change the wording.

Gill published his findings in March 2024, two years after originally discovering the issue, because BlackVue had not made any changes. His post included an e-mail exchange with BlackVue UK, in which a representative called the public broadcasting of location, video, and audio "a case of personal choice" and described it as "a mature [feature], having been available for nearly 5 years."

On 22 June 2026, Nine News Australia reported that an Australian BlackVue customer could view the real-time location, live video, and in-car audio of other BlackVue users worldwide through a map feature in the app, without those users' apparent knowledge. Nine technology commentator Trevor Long called it "one of the biggest privacy or security concerns" he had seen, estimating only "one per cent of people" using the feature realised it was public. BlackVue's Australian distributor told Nine it was compliant with Australia's Cyber Security Act and called the report "sensationalist and inaccurate." The next day, BlackVue Australia published a blog post claiming footage was "private by default, full stop," contradicting both the Nine News demonstration and the company's 2022 and 2024 statements described above. On 26 June 2026, Tech Guide reported it had independently verified the issue in Australia, New Zealand, and the United States; BlackVue then removed Australian cameras from public view and said it was working with "the manufacturer" to eliminate the live-broadcast feature entirely.

Firmware security vulnerabilities

DR750 (CVE-2023-27746, CVE-2023-27747, CVE-2023-27748)

In July 2022, a security researcher reported three vulnerabilities in the BlackVue DR750-2CH LTE (firmware v1.012_2022.10.26) to Pittasoft. The company was informed but did not issue a patch. The CVEs were published in the National Vulnerability Database on 13 April 2023:

• CVE-2023-27748 (CVSS 9.8 Critical): The DR750's FOTA (firmware over the air) service on port 9771/TCP performs no authenticity check on uploaded firmware. An attacker on the same network or on the internet (for LTE-connected devices) can upload firmware containing backdoors.
• CVE-2023-27746 (CVSS 9.8 Critical): The default Wi-Fi passphrase uses only 8 lowercase alphanumeric characters, allowing brute-force cracking.
• CVE-2023-27747 (CVSS 7.5 High): The dashcam's built-in web server has no authentication, allowing anyone on the network to access live video feeds, download all recordings, and retrieve device configurations.

At the time of disclosure, approximately 300 vulnerable DR750 devices were discoverable online. No official patch has been released.

DR590X (CVE-2025-7075, CVE-2025-7076, CVE-2025-2355, CVE-2025-2356)

On 25 February 2025, a researcher by the user name of geo-chen disclosed four vulnerabilities in the BlackVue DR590X to Pittasoft. The company acknowledged the report on 16 February and accepted the vulnerabilities on 5 March 2025.

• CVE-2025-7075 (CVSS 8.8 High): An unauthenticated /upload.cgi endpoint allows arbitrary file uploads, including malicious code, when connected to the dashcam's network.
• CVE-2025-7076: The same upload mechanism allows modification of device configurations, including the ability to disable battery protection and drain the vehicle's battery.
• CVE-2025-2355: The BlackVue v3.65 Android APK exposes both the BCS_TOKEN and SECRET_KEY in plaintext.
• CVE-2025-2356: Sensitive API endpoints transmit authentication tokens via GET parameters, exposing them in browser history, referral URLs, and proxy logs. The endpoints allow unauthorized calls to change device settings, including deleting a device from an account.

Cloud subscription tier removal (January 2025)

In January 2025, Pittasoft notified existing BlackVue Cloud users that all cloud services would become subscription-only starting in February 2025, discontinuing a tier the company had previously marketed as "Free Forever." Users reported that BlackVue was still advertising the "Free Forever" plan on its website while sending e-mails notifying customers of the change. One user reported the new subscription cost was $16 per month.

BlackVue Cloud features include remote live view, GPS tracking, two-way voice communication, live event upload, and cloud video backup. The transition to paid-only access means owners of cloud-compatible dashcams who relied on the free tier lost remote access features they had been using since purchasing their hardware.

Mandatory app registration (March 2025)

Main article: BlackVue mandatory app registration

On 13 March 2025, Pittasoft announced that a BlackVue account would be required to use the companion app. The announcement stated that "Non-login Wi-Fi Mode will no longer be available," removing the ability to connect to a locally present dashcam without first creating an account and logging in over the internet.

This was Pittasoft's second attempt to require mandatory registration. In March 2023, an app update required users to log in to access their dashcam. After user complaints on forums and app stores, BlackVue released version 3.42 on 23 March 2023, which added a guest mode for direct Wi-Fi access without login. In 2025, BlackVue removed that guest mode.

Android app version 3.66 (released 1 April 2025) and iOS version 4.0 (released 3 April 2025) implemented the mandatory account requirement. The app's changelog listed "BlackVue account now required" under "Important Changes." An offline mode allows local access after the initial login, but the first login requires an internet connection.

The Android app version 3.66 requests 43 permissions according to APKMirror, rising to 44 permissions in version 4.15. Pittasoft's privacy policy discloses the use of Meta Events Manager, HubSpot Analytics, and TikTok conversion tracking for advertising and analytics purposes.

On the Apple App Store, the app holds a 3.8 out of 5 rating from approximately 2,200 ratings.

Products

BlackVue's current lineup includes:

• ELITE Series (ELITE 8, ELITE 9, ELITE 10): Premium tier with 4K UHD recording and Sony STARVIS 2 sensors
• DR970X Series: 4K recording with 8MP Sony STARVIS sensors, available with built-in LTE
• DR770X Series: Full HD at 60fps, available in 1-channel, 2-channel, and truck variants
• DR590X Series: Entry-level line
• BOX Series: Tamper-proof recording unit separate from camera lenses

See also

• Planned obsolescence
• Subscription lock-in