BlackVue firmware security vulnerabilities are a set of 7 CVEs across 2 BlackVue dashcam models that allow attackers to upload backdoored firmware, access live video feeds & stored recordings without authentication, and exploit hardcoded API secrets embedded in plaintext in BlackVue's mobile app.[1][2] The first 3 CVEs affecting the DR750 were reported to BlackVue on July 30, 2022.[1] As of 2026, BlackVue has not patched the DR750 vulnerabilities, leaving roughly 300 internet-connected devices exposed.[1]
Background
editBlackVue manufactures cloud-connected dashcams that provide remote access to live feeds, GPS tracking, & stored recordings through WiFi & cellular (LTE) connections. The DR750-2CH LTE model connects directly to the internet via its built-in LTE modem, making its services reachable without requiring proximity to the vehicle's WiFi network.[1]
Two independent security researchers audited BlackVue dashcams roughly 2.5 years apart. The first researcher (eyJhb) reported 3 vulnerabilities in the DR750 in July 2022. The second researcher (Geo Chen) disclosed 4 vulnerabilities in the DR590X in February 2025.[1][2]
DR750 vulnerabilities (CVE-2023-27746, CVE-2023-27747, CVE-2023-27748)
editThe DR750-2CH LTE running firmware v1.012-eng contained 3 critical-to-high severity vulnerabilities that, chained together, allow full remote compromise of the device.[1]
Weak default WiFi passphrase (CVE-2023-27746)
editThe DR750's default WiFi password uses only lowercase alphanumeric characters with a length of 8.[1] This character set produces a keyspace small enough to brute-force from a captured WiFi handshake. The researcher estimated the password could be cracked in roughly 4 days using rented cloud hardware costing approximately 40 EUR.[1] The NVD assigned this vulnerability a CVSS score of 9.8 (Critical).[3]
Unauthenticated web server (CVE-2023-27747)
editA built-in web server on the DR750 exposes live video feeds, position & speed telemetry, stored recordings, & device configuration downloads without any authentication.[1] Anyone on the same network (or anyone on the internet for LTE-connected models) can access these endpoints.[1] The configuration download includes encrypted WiFi credentials.[1] The NVD assigned a CVSS score of 7.5 (High).[4]
Unauthenticated firmware upload (CVE-2023-27748)
editPort 9771/TCP on the DR750 hosts a FOTA (firmware over-the-air) service with no authentication & no firmware authenticity check.[1] An attacker can upload custom firmware containing a backdoor.[1] The dashcam has no firewall, so on LTE models this port is reachable from the public internet.[1] Custom firmware persists even after a user reinstalls the official firmware, giving the attacker persistent root access to the device.[1] The NVD assigned a CVSS score of 9.8 (Critical).[5]
BlackVue's response
editBlackVue acknowledged it would investigate but has not released a patch.[1] At the time of disclosure, approximately 300 vulnerable DR750 devices were identified as publicly accessible on the internet.[1]
DR590X vulnerabilities (CVE-2025-7075, CVE-2025-7076, CVE-2025-2355, CVE-2025-2356)
editSecurity researcher Geo Chen disclosed 4 vulnerabilities in the BlackVue DR590X dashcam & its companion mobile app on February 25, 2025.[2]
Unauthenticated file upload (CVE-2025-7075)
editThe DR590X exposes an /upload.cgi endpoint at http://10.99.77.1/upload.cgi with no authentication. Any device on the dashcam's WiFi network can upload arbitrary files, including malware, to the dashcam.[2] The NVD assigned a CVSS score of 8.8 (High).[6]
Unauthenticated configuration modification (CVE-2025-7076)
editThrough the same upload mechanism, an attacker can modify the dashcam's configuration file without authentication. This allows disabling battery protection on the dashcam, which can drain the vehicle's battery.[2] The NVD assigned a CVSS score of 8.8 (High).[7]
Hardcoded secrets in mobile app (CVE-2025-2355)
editThe BlackVue v3.65 APK contains hardcoded BCS_TOKEN & SECRET_KEY values in plaintext.[8] These client secrets are transmitted via GET parameters, which means they appear in browser history, referral URLs, & proxy logs.[2]
Unauthorized API calls (CVE-2025-2356)
editUsing tokens extracted from the APK or intercepted from GET parameters, an attacker can make API calls to delete devices from a user's account & modify device settings without authorization.[2] The userToken is transmitted via GET parameters rather than POST request bodies or authorization headers, exposing it to the same logging & interception risks as the hardcoded secrets.[2][9]
Disclosure timeline
editGeo Chen reported the DR590X vulnerabilities to BlackVue on February 25, 2025. BlackVue acknowledged the report on February 26, 2025, & accepted the findings on March 5, 2025. CVEs were published on March 16, 2025.[2]
Consumer impact
editBoth sets of vulnerabilities expose dashcam owners to surveillance & vehicle tampering risks that cannot be mitigated through software settings.[1][2] The DR750's LTE connectivity means the firmware upload vulnerability (CVE-2023-27748) is exploitable remotely without physical proximity to the vehicle.[1] A compromised dashcam can serve as a persistent surveillance device, streaming live video, audio, & GPS location data to an attacker.[1]
The DR590X's battery protection bypass (CVE-2025-7076) introduces a physical consequence: an attacker within WiFi range can disable the dashcam's voltage cutoff, causing it to drain the vehicle's 12V battery.[2] The hardcoded API secrets (CVE-2025-2355) & unauthorized API access (CVE-2025-2356) extend the attack surface beyond the local network to BlackVue's cloud infrastructure, allowing remote account & device manipulation.[2]
The DR750 vulnerabilities remain unpatched more than 3 years after the initial report to the vendor.[1] BlackVue accepted the DR590X findings on March 5, 2025, but as of the CVE publication date had not announced fixes for those vulnerabilities either.[2]
See also
editReferences
edit- ↑ 1.00 1.01 1.02 1.03 1.04 1.05 1.06 1.07 1.08 1.09 1.10 1.11 1.12 1.13 1.14 1.15 1.16 1.17 1.18 1.19 1.20 eyJhb (2023). "BlackVue CVE-2023 - Security Vulnerabilities in BlackVue DR750". GitHub. Retrieved 2026-03-28.
- ↑ 2.00 2.01 2.02 2.03 2.04 2.05 2.06 2.07 2.08 2.09 2.10 2.11 2.12 Geo Chen (2025-02-25). "BlackVue Dashcam 590X Security Vulnerabilities". GitHub. Retrieved 2026-03-28.
- ↑ "CVE-2023-27746 Detail". National Vulnerability Database. Retrieved 2026-03-28.
- ↑ "CVE-2023-27747 Detail". National Vulnerability Database. Retrieved 2026-03-28.
- ↑ "CVE-2023-27748 Detail". National Vulnerability Database. Retrieved 2026-03-28.
- ↑ "CVE-2025-7075 Detail". National Vulnerability Database. Retrieved 2026-03-28.
- ↑ "CVE-2025-7076 Detail". National Vulnerability Database. Retrieved 2026-03-28.
- ↑ "CVE-2025-2355 Detail". National Vulnerability Database. Retrieved 2026-03-28.
- ↑ "CVE-2025-2356 Detail". National Vulnerability Database. Retrieved 2026-03-28.