CVE-2025-30125

An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. All dashcams were shipped with the same default credentials of 12345678, which creates an insecure-by-default condition. For users who change their passwords, it's limited to 8 characters. These short passwords can be cracked in 8 hours via low-end commercial cloud resources.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://geochen.medium.com/marbella-dashcam-ab40ca41ade
https://github.com/geo-chen/Marbella/
https://github.com/geo-chen/Marbella/blob/main/README.md#finding-1---cve-2025-30125-same-default-credentials-and-limited-password-combinations
https://makagps.com/
https://www.protiviti.com/sg-en/blogs/6259-8-character-password-still-dead
https://github.com/geo-chen/Marbella/blob/main/README.md#finding-1---cve-2025-30125-same-default-credentials-and-limited-password-combinations

Configurations

No configuration.

History

No history.

Information

Published : 2025-07-28 15:15

Updated : 2025-07-30 16:15

NVD link : CVE-2025-30125

Mitre link : CVE-2025-30125

CVE.ORG link : CVE-2025-30125

JSON object : View

Products Affected

No product.

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2025-30125", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-07-28T15:15:26.337", "references": [{"url": "https://geochen.medium.com/marbella-dashcam-ab40ca41ade", "source": "[email protected]"}, {"url": "https://github.com/geo-chen/Marbella/", "source": "[email protected]"}, {"url": "https://github.com/geo-chen/Marbella/blob/main/README.md#finding-1---cve-2025-30125-same-default-credentials-and-limited-password-combinations", "source": "[email protected]"}, {"url": "https://makagps.com/", "source": "[email protected]"}, {"url": "https://www.protiviti.com/sg-en/blogs/6259-8-character-password-still-dead", "source": "[email protected]"}, {"url": "https://github.com/geo-chen/Marbella/blob/main/README.md#finding-1---cve-2025-30125-same-default-credentials-and-limited-password-combinations", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. All dashcams were shipped with the same default credentials of 12345678, which creates an insecure-by-default condition. For users who change their passwords, it's limited to 8 characters. These short passwords can be cracked in 8 hours via low-end commercial cloud resources."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Marbella KR8s Dashcam FF 2.0.8 devices. Todas las c\u00e1maras de salpicadero se entregaron con las mismas credenciales predeterminadas, 12345678, lo que genera una condici\u00f3n de inseguridad predeterminada. Para los usuarios que cambian sus contrase\u00f1as, esta est\u00e1 limitada a 8 caracteres. Estas contrase\u00f1as cortas se pueden descifrar en 8 horas mediante recursos comerciales de bajo coste en la nube."}], "lastModified": "2025-07-30T16:15:26.617", "sourceIdentifier": "[email protected]"}