Consumer Rights Wiki

BlackVue

Revision as of 04:20, 29 March 2026 by Louis (talk | contribs) (fixed cve-2355/2356 conflation, 2.2k ratings not 2197, removed unsourced seoul, trimmed unsourced inference)


BlackVue is a dashcam brand manufactured by Pittasoft Co. Ltd., a privately held South Korean company founded in 2007.[1] Since 2018, multiple independent security researchers have found that BlackVue's Cloud service broadcasts users' real-time GPS locations, live video feeds, & audio to anyone with a free account.[2] Seven CVEs across two product lines remain unpatched or were only acknowledged after public disclosure,[3][4] and in April 2025 Pittasoft began requiring a BlackVue account to use the companion app, removing the ability to access a locally connected dashcam without an internet login.[5]

BlackVue
[[File:|200px]]
Basic information
Founded 2007
Legal Structure Private
Industry Electronics,Automotive
Also known as Pittasoft,Pittasoft Co. Ltd.
Official website https://blackvue.com/

Consumer-impact summary

  • User privacy: BlackVue Cloud has broadcast users' GPS coordinates, live video, & audio to anyone with a free app account since at least 2018. BlackVue called this "a feature, not a bug."[2]
  • Device security: Seven CVEs (two CVSS 9.8 Critical, two CVSS 8.8 High, one CVSS 7.5 High) across the DR750 & DR590X product lines allow remote firmware backdooring, unauthenticated access to recordings, & hardcoded API secrets. The DR750 vulnerabilities reported in July 2022 remain unpatched.[3][4]
  • User freedom: Since April 2025, the BlackVue companion app requires a BlackVue account to access a locally connected dashcam. Non-login Wi-Fi Mode was removed.[5]
  • Subscription lock-in: In early 2025, Pittasoft discontinued its "Free Forever" cloud tier & moved all cloud features to paid subscriptions, breaking a promise made to existing customers.[6]

Background

Pittasoft Co. Ltd. was founded on July 2, 2007, in South Korea, by Hyunmin Hur.[1][7] The company initially focused on IP CCTV solutions before pivoting to dashboard cameras. The BlackVue brand launched in 2010 with the DR300, the company's first dashcam.[7] In 2015, Pittasoft introduced BlackVue Over the Cloud, a connected service that allows remote live viewing, GPS tracking, & push notifications through an internet-connected dashcam.[7]

Pittasoft manufactures its dashcams in South Korea.[7] The company is privately held & has not raised institutional funding or executed an IPO.[1]

Incidents

GPS location broadcasting

Main article: BlackVue GPS location broadcasting

In October 2018, CSO Online reported that BlackVue dashcam owners were unknowingly broadcasting their real-time GPS coordinates, live video, & audio through BlackVue Cloud. The default cloud configuration when enabling the service opted users into public sharing without warning.[8]

Vice journalist Joseph Cox investigated further in January 2020, reverse-engineering the BlackVue iOS app & wrote scripts that collected the GPS locations of every BlackVue user with mapping enabled on the eastern half of the United States every two minutes over a week-long period.[9] The researchers tracked users in Manhattan, Brooklyn, Queens, South Carolina, Hong Kong, China, Russia, the UK, & Germany. A BlackVue spokesperson told Vice that collecting multiple users' GPS coordinates over extended periods "is not supposed to be possible" & claimed the company had updated security measures.[9]

The issue resurfaced in January 2022 when cybersecurity researcher Andy Gill reported the same problem to CyberNews. By downloading the free BlackVue app & registering an account (which required no email verification), anyone could view the GPS locations & live video feeds of connected dashcams.[2] BlackVue responded that sharing is "opt-in only" & claimed all cameras are set to private by default, but Gill's testing showed GPS access was enabled by default.[2] BlackVue acknowledged that "some information might be misleading" & said it would change the wording.[2]

Gill published his findings in March 2024, two years after originally discovering the issue, because BlackVue had not made any changes. His post included an email exchange with BlackVue UK, in which a representative called the public broadcasting of location, video, & audio "a case of personal choice" & described it as "a mature [feature], having been available for nearly 5 years."[10]

Firmware security vulnerabilities

DR750 (CVE-2023-27746, CVE-2023-27747, CVE-2023-27748)

In July 2022, a security researcher reported three vulnerabilities in the BlackVue DR750-2CH LTE (firmware v1.012_2022.10.26) to Pittasoft. The company was informed but did not issue a patch.[3] The CVEs were published in the National Vulnerability Database on April 13, 2023:

  • CVE-2023-27748 (CVSS 9.8 Critical): The DR750's FOTA (firmware over the air) service on port 9771/TCP performs no authenticity check on uploaded firmware. An attacker on the same network or on the internet (for LTE-connected devices) can upload firmware containing backdoors.[11]
  • CVE-2023-27746 (CVSS 9.8 Critical): The default Wi-Fi passphrase uses only 8 lowercase alphanumeric characters, allowing brute-force cracking.[12]
  • CVE-2023-27747 (CVSS 7.5 High): The dashcam's built-in web server has no authentication, allowing anyone on the network to access live video feeds, download all recordings, & retrieve device configurations.[13]

At the time of disclosure, approximately 300 vulnerable DR750 devices were discoverable online.[3] No official patch has been released.[3]

DR590X (CVE-2025-7075, CVE-2025-7076, CVE-2025-2355, CVE-2025-2356)

On February 25, 2025, researcher geo-chen disclosed four vulnerabilities in the BlackVue DR590X to Pittasoft. The company acknowledged the report on February 26 & accepted the vulnerabilities on March 5, 2025.[4]

  • CVE-2025-7075 (CVSS 8.8 High): An unauthenticated /upload.cgi endpoint allows arbitrary file uploads, including malicious code, when connected to the dashcam's network.[14]
  • CVE-2025-7076: The same upload mechanism allows modification of device configurations, including the ability to disable battery protection & drain the vehicle's battery.[4]
  • CVE-2025-2355: The BlackVue v3.65 Android APK exposes both the BCS_TOKEN & SECRET_KEY in plaintext.[4]
  • CVE-2025-2356: Sensitive API endpoints transmit authentication tokens via GET parameters, exposing them in browser history, referral URLs, & proxy logs. The endpoints allow unauthorized calls to change device settings, including deleting a device from an account.[4]

Mandatory app registration

Main article: BlackVue mandatory app registration

On March 13, 2025, Pittasoft announced that a BlackVue account would be required to use the companion app. The announcement stated that "Non-login Wi-Fi Mode will no longer be available," removing the ability to connect to a locally present dashcam without first creating an account & logging in over the internet.[5]

This was Pittasoft's second attempt to require mandatory registration. In March 2023, an app update required users to log in to access their dashcam. After user complaints on forums & app stores, BlackVue released version 3.42 on March 23, 2023, which added a Guest mode for direct Wi-Fi access without login.[15] In 2025, BlackVue removed that Guest mode.

Android app version 3.66 (released April 1, 2025) & iOS version 4.0 (released April 3, 2025) implemented the mandatory account requirement.[16] The app's changelog listed "BlackVue account now required" under "Important Changes." An offline mode allows local access after the initial login, but the first login requires an internet connection.[16]

The Android app version 3.66 requests 43 permissions according to APKMirror, rising to 44 permissions in version 4.15.[16] Pittasoft's privacy policy discloses the use of Meta Events Manager, HubSpot Analytics, & TikTok conversion tracking for advertising & analytics purposes.[17]

On the Apple App Store, the app holds a 3.8 out of 5 rating from approximately 2,200 ratings. Users reported that "App worked just fine for years PRIOR to their requiring you to have an account" & that "NOBODY needs or wants an account" to view local videos on cameras they already own.[18]

Cloud subscription tier removal

In January 2025, Pittasoft notified existing BlackVue Cloud users that all cloud services would become subscription-only starting in February 2025, discontinuing a tier the company had previously marketed as "Free Forever."[6] Users reported that BlackVue was still advertising the "Free Forever" plan on its website while sending emails notifying customers of the change. One user reported the new subscription cost was $16 per month.[6]

BlackVue Cloud features include remote live view, GPS tracking, two-way voice communication, live event upload, & cloud video backup.[19] The transition to paid-only access means owners of cloud-compatible dashcams who relied on the free tier lost remote access features they had been using since purchasing their hardware.

Products

BlackVue's current lineup includes:

  • ELITE Series (ELITE 8, ELITE 9, ELITE 10): Premium tier with 4K UHD recording & Sony STARVIS 2 sensors
  • DR970X Series: 4K recording with 8MP Sony STARVIS sensors, available with built-in LTE
  • DR770X Series: Full HD at 60fps, available in 1-channel, 2-channel, & truck variants
  • DR590X Series: Entry-level line
  • BOX Series: Tamper-proof recording unit separate from camera lenses

See also

References

  1. ↑ 1.0 1.1 1.2 "BlackVue Company Profile". Tracxn. Retrieved 2026-03-28.
  2. ↑ 2.0 2.1 2.2 2.3 2.4 Lapienytė, Jurgita (2022-01-12). "BlackVue dash cameras let you track other users; the company says it's a feature, not a bug". CyberNews. Retrieved 2026-03-28.
  3. ↑ 3.0 3.1 3.2 3.3 3.4 "BlackVue DR750 CVE". GitHub. Retrieved 2026-03-28.
  4. ↑ 4.0 4.1 4.2 4.3 4.4 4.5 "BlackVue Security Vulnerabilities". GitHub. Retrieved 2026-03-28.
  5. ↑ 5.0 5.1 5.2 "Discover the Latest BlackVue App Update: Enhanced UI, New Features, and More". BlackVue. 2025-03-13. Archived from the original on 2025-09-11. Retrieved 2026-03-28.
  6. ↑ 6.0 6.1 6.2 "BlackVue Still Advertising Their "Free Forever" Plan After Notifying All Existing Users BlackVue Cloud Services Will be Subscription Only Starting 02/2025". Reddit r/Dashcam. 2025-01-04. Retrieved 2026-03-28.
  7. ↑ 7.0 7.1 7.2 7.3 "About Us". BlackVue Singapore. Retrieved 2026-03-28.
  8. ↑ Smith, Ms. (2018-10-02). "BlackVue dashcams share cars' mapped GPS locations, stream video feeds and audio". CSO Online. Retrieved 2026-03-28.
  9. ↑ 9.0 9.1 Cox, Joseph (2020-01-16). "This App Lets Us See Everywhere People Drive". Vice/Motherboard. Retrieved 2026-03-28.
  10. ↑ Gill, Andy (2024-03-15). "BlackVue Dashcams - It's not a bug, it is a feature". ZephrSec. Retrieved 2026-03-28.
  11. ↑ "CVE-2023-27748 Detail". National Vulnerability Database. 2023-04-13. Retrieved 2026-03-28.
  12. ↑ "CVE-2023-27746 Detail". National Vulnerability Database. 2023-04-13. Retrieved 2026-03-28.
  13. ↑ "CVE-2023-27747 Detail". National Vulnerability Database. 2023-04-13. Retrieved 2026-03-28.
  14. ↑ "CVE-2025-7075 Detail". National Vulnerability Database. 2025-07-05. Retrieved 2026-03-28.
  15. ↑ "New Blackvue App 2023: HORRID". DashCamTalk. 2023-03-15. Retrieved 2026-03-28.
  16. ↑ 16.0 16.1 16.2 "BlackVue 3.66 APK". APKMirror. 2025-04-01. Retrieved 2026-03-28.
  17. ↑ "BlackVue Privacy Policy". Iubenda. 2025-05-18. Retrieved 2026-03-28.
  18. ↑ "BlackVue on the App Store". Apple App Store. Retrieved 2026-03-28.
  19. ↑ "BlackVue Over the Cloud". The Dashcam Store. Retrieved 2026-03-28.
Retrieved from "https://consumerrights.wiki/index.php?title=BlackVue&oldid=48241"