CVE-2025-30117

An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. After bypassing the device pairing, an attacker can obtain sensitive user and vehicle information through the settings interface. Remote attackers can modify power management settings, disable recording, delete stored footage, and turn off battery protection, leading to potential denial-of-service conditions and vehicle battery drainage.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/geo-chen/Hella	Third Party Advisory
https://medium.com/@geochen/cve-draft-hella-driving-recorder-dr-820-ff8c4e2cca26	Permissions Required

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:hella:dr_820_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:hella:dr_820:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-18 15:16

Updated : 2025-05-22 19:40

NVD link : CVE-2025-30117

Mitre link : CVE-2025-30117

CVE.ORG link : CVE-2025-30117

JSON object : View

Products Affected

hella

dr_820
dr_820_firmware

CWE

CWE-285

Improper Authorization

{"id": "CVE-2025-30117", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "published": "2025-03-18T15:16:02.990", "references": [{"url": "https://github.com/geo-chen/Hella", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://medium.com/@geochen/cve-draft-hella-driving-recorder-dr-820-ff8c4e2cca26", "tags": ["Permissions Required"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. After bypassing the device pairing, an attacker can obtain sensitive user and vehicle information through the settings interface. Remote attackers can modify power management settings, disable recording, delete stored footage, and turn off battery protection, leading to potential denial-of-service conditions and vehicle battery drainage."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Forvia Hella HELLA Driving Recorder DR 820. La gesti\u00f3n de la configuraci\u00f3n, la obtenci\u00f3n de datos confidenciales y el sabotaje de la bater\u00eda del coche pueden ser realizados por personas no autorizadas. Tras eludir la sincronizaci\u00f3n del dispositivo, un atacante puede obtener informaci\u00f3n confidencial del usuario y del veh\u00edculo a trav\u00e9s de la interfaz de configuraci\u00f3n. Los atacantes remotos pueden modificar la configuraci\u00f3n de administraci\u00f3n de energ\u00eda, desactivar la grabaci\u00f3n, eliminar las grabaciones almacenadas y desactivar la protecci\u00f3n de la bater\u00eda, lo que puede provocar una denegaci\u00f3n de servicio y la descarga de la bater\u00eda del veh\u00edculo."}], "lastModified": "2025-05-22T19:40:48.057", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hella:dr_820_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53788D10-80DC-4A88-9472-D8D0CD20A457"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hella:dr_820:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "ADEE1CDA-ADA2-46F0-B689-C3E75A6C40D3"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}