CVE-2025-30125: Default Password Vulnerability in Marbella KR8s Dashcam FF 2.0.8

Overview

The CVE-2025-30125 is a serious cybersecurity vulnerability in Marbella KR8s Dashcam FF 2.0.8 devices. This vulnerability stems from the fact that all devices are shipped with the same default credentials of ‘12345678’. This creates an insecure-by-default condition that could potentially expose users to significant cyber threats. Furthermore, even when users change these default passwords, they are limited to a maximum of 8 characters, which can be cracked within 8 hours using low-end commercial cloud resources. This vulnerability poses a significant risk to all users of these dashcam devices and requires immediate attention.

Vulnerability Summary

CVE ID: CVE-2025-30125
Severity: Critical (9.8 CVSS score)
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

Marbella KR8s Dashcam | FF 2.0.8

How the Exploit Works

The attacker, upon knowing the default credentials, can easily gain unauthorized access to the dashcam’s system. If the user has changed the password, the attacker can employ brute-force attacks using cloud resources to crack the 8-character password within hours. Once access is gained, they can compromise the system or leak sensitive data.

Conceptual Example Code

In this hypothetical scenario, an attacker might perform a brute force attack using a simple script, which could look something like this:

#!/bin/bash
for password in $(cat password_list.txt); do
curl -X POST -d "username=admin&password=$password" http://target_IP/login
if [ $? -eq 0 ]; then
echo "Login successful with password: $password"
exit 0
fi
done

In this script, ‘password_list.txt’ is a file containing a list of potential 8-character passwords. The script tries each password in the list until it finds one that successfully logs in.

Mitigation Guidance

The best way to mitigate this vulnerability is to apply the vendor patch as soon as it becomes available. In the meantime, users can use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as temporary mitigation. It is also advisable to change the default password to a complex one and regularly update it even if it’s limited to 8 characters.