CVE-2025-30139

An issue was discovered on G-Net Dashcam BB GONX devices. Default credentials for SSID cannot be changed. It broadcasts a fixed SSID with default credentials that cannot be changed. This allows any nearby attacker to connect to the dashcam's network without restriction. Once connected, an attacker can sniff on connected devices such as the user's smartphone. The SSID is also always broadcasted.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/geo-chen/GNET	Third Party Advisory
https://www.gnetsystem.com/eng/product/list?viewMode=view&idx=246&ca_id=0201	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:gnetsystem:g-onx_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:gnetsystem:g-onx:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-18 20:15

Updated : 2025-07-01 21:04

NVD link : CVE-2025-30139

Mitre link : CVE-2025-30139

CVE.ORG link : CVE-2025-30139

JSON object : View

Products Affected

gnetsystem

g-onx
g-onx_firmware

CWE

CWE-1392

Use of Default Credentials

{"id": "CVE-2025-30139", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-03-18T20:15:26.597", "references": [{"url": "https://github.com/geo-chen/GNET", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.gnetsystem.com/eng/product/list?viewMode=view&idx=246&ca_id=0201", "tags": ["Product"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-1392"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on G-Net Dashcam BB GONX devices. Default credentials for SSID cannot be changed. It broadcasts a fixed SSID with default credentials that cannot be changed. This allows any nearby attacker to connect to the dashcam's network without restriction. Once connected, an attacker can sniff on connected devices such as the user's smartphone. The SSID is also always broadcasted."}, {"lang": "es", "value": "Se detect\u00f3 un problema en los dispositivos G-Net Dashcam BB GONX. Las credenciales predeterminadas del SSID no se pueden cambiar. Transmite un SSID fijo con credenciales predeterminadas que no se pueden cambiar. Esto permite que cualquier atacante cercano se conecte a la red de dashcam sin restricciones. Una vez conectado, un atacante puede rastrear dispositivos conectados, como el smartphone del usuario. El SSID tambi\u00e9n se transmite siempre."}], "lastModified": "2025-07-01T21:04:40.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:gnetsystem:g-onx_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2120C516-F31B-406B-BC9A-4397D10EDDA3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:gnetsystem:g-onx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D2E9038F-6802-4704-805F-FC76FD268CCE"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}