Overview
A critical vulnerability has been discovered in Marbella KR8s Dashcam FF 2.0.8 devices. This vulnerability, identified as CVE-2025-30124, poses a significant risk for users as it allows an attacker to access sensitive data. This issue arises when a new SD card is inserted into the dashcam, automatically storing the existing password in clear-text onto the SD card. If an attacker gains temporary access to the dashcam, they can simply switch the SD card to steal this password. The severity of this vulnerability underscores the need for robust security measures and immediate mitigation.
This vulnerability is particularly concerning as it has a high potential for system compromise or data leakage, affecting all users of Marbella KR8s Dashcam FF 2.0.8 devices. Given the prevalence of these devices, it is vital to address this vulnerability promptly to protect users’ sensitive information from falling into the wrong hands.
Vulnerability Summary
CVE ID: CVE-2025-30124
Severity: Critical (9.8 CVSS Severity Score)
Attack Vector: Physical access to the device
Privileges Required: None
User Interaction: Required (User must insert a new SD card)
Impact: System compromise, Data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Marbella KR8s Dashcam | FF 2.0.8
How the Exploit Works
This exploit takes advantage of the fact that Marbella KR8s Dashcam FF 2.0.8 devices automatically write the existing password in clear-text onto a newly inserted SD card. An attacker with temporary physical access to the device can replace the SD card and later read the stored password directly from the SD card using a standard card reader.
Conceptual Example Code
Here’s a conceptual shell command example showing how an attacker may read the stolen password from the SD card:
# Assume /dev/sdb is the SD card
mount /dev/sdb /mnt/sdcard
cat /mnt/sdcard/password.txtThe above command sequence mounts the SD card and reads the clear-text password from the file where the dashcam device stores it.