CVE-2025-30127: Critical Security Vulnerability in Marbella KR8s Dashcam FF 2.0.8

Overview

The CVE-2025-30127 is a critical security vulnerability found in the Marbella KR8s Dashcam FF 2.0.8 devices. It was discovered that once unauthorized access is obtained, either via default, common, or cracked passwords, a potential attacker could access sensitive data such as video recordings, conversations, and footage. This poses a significant security risk to users of these devices as unauthorized access could lead to system compromise or data leakage.
This vulnerability is especially concerning due to the nature of the information that is exposed – sensitive routes, conversations, and footage, which could potentially be used maliciously. It’s a critical issue that needs to be addressed to ensure the privacy and security of users.

Vulnerability Summary

CVE ID: CVE-2025-30127
Severity: Critical (9.8)
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: System compromise and data leakage

Affected Products

Product | Affected Versions

Marbella KR8s Dashcam | FF 2.0.8

How the Exploit Works

The exploit works by gaining unauthorized access to the Marbella KR8s Dashcam devices. This can be achieved through various methods such as using default or common passwords or by cracking the password. Once access is gained, an attacker can create a socket to command port 7777, which allows them to download video via port 7778 and audio via port 7779. This exposes sensitive information such as video recordings, conversations, and footage to potential misuse.

Conceptual Example Code

Here is a conceptual example of how an attacker might exploit this vulnerability. This is not an actual exploit code, but rather a simple illustration of the exploit concept:

# Establish connection to the device
ssh user@target_device_IP_address -p 7777
# Once the connection is established and access is gained, the attacker can download video and audio via ports 7778 and 7779 respectively.
# Download video
nc target_device_IP_address 7778 > video_file
# Download audio
nc target_device_IP_address 7779 > audio_file

Please note that the actual exploitation would be more complex and could involve more sophisticated techniques and tools. This example is only for illustrative purposes to explain the concept of the vulnerability.