CVE-2025-1879: I-drive I11 Firmware Auth Bypass Vulnerability

CVE-2025-1879 Overview

CVE-2025-1879 is a hard-coded credentials vulnerability affecting i-Drive i11 and i12 dashcam devices with firmware up to version 20250227. The flaw resides in the companion Android APK and stems from credentials embedded directly in the application code [CWE-798]. Exploitation requires physical access to the device, which limits the practical attack surface. The affected product line appears to be end-of-life, and no maintainer could be identified to coordinate a fix.

Critical Impact
An attacker with physical access can extract embedded credentials from the APK and use them to interact with the device, potentially compromising confidentiality of stored or transmitted data.

Affected Products

i-Drive i11 (hardware and firmware up to 20250227)
i-Drive i12 (hardware and firmware up to 20250227)
Associated Android companion APK

Discovery Timeline

2025-03-03 - CVE-2025-1879 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1879

Vulnerability Analysis

The vulnerability affects the companion Android APK used to pair with i-Drive i11 and i12 devices. Reverse engineering of the APK reveals credentials stored as static values within the application binary. Because the attack vector is physical, an adversary must either obtain the device or the mobile application to extract the credentials. Once recovered, those credentials can be reused against any device sharing the same firmware image.

The issue is classified under [CWE-259] Use of Hard-coded Password and [CWE-798] Use of Hard-coded Credentials. Both weaknesses share the same root problem: authentication material that cannot be rotated per-device or per-user. Any customer replacing the credentials would need firmware modification, which is unlikely for consumer dashcam hardware.

Root Cause

The developers embedded authentication material directly into the APK rather than provisioning per-device secrets during pairing. Static analysis of the decompiled APK exposes the values without requiring runtime instrumentation. The absence of a maintainer means no upstream fix is expected.

Attack Vector

An attacker must first obtain the APK or physical access to the paired device. After decompilation using standard tooling such as apktool or jadx, the hard-coded strings can be recovered from the resource or class files. The attacker then uses those credentials to authenticate to the device over its local interface. See the GitHub i-Drive research repository and the VulDB entry #298193 for technical details.

No verified proof-of-concept code is published; the vulnerability is described in prose in the referenced advisories.

Detection Methods for CVE-2025-1879

Indicators of Compromise

Unexpected pairing events on i-Drive i11 or i12 devices from unknown mobile clients
Presence of the i-Drive APK on devices belonging to users who do not own the hardware
Network traffic to the dashcam's local access point from unauthorized MAC addresses

Detection Strategies

Perform static analysis of the vendor APK to confirm the presence of embedded credential strings and inventory affected app versions.
Monitor wireless environments where these devices operate for unauthorized association attempts to the dashcam SSID.
Track mobile device management (MDM) inventories for installations of the i-Drive companion app on corporate handsets.

Monitoring Recommendations

Log authentication events on device local interfaces where feasible and alert on repeated pairing attempts.
Ingest wireless intrusion detection telemetry into a centralized data lake to correlate proximity-based attacks against IoT hardware.
Review physical security controls for vehicles or locations where affected devices are deployed.

How to Mitigate CVE-2025-1879

Immediate Actions Required

Treat the affected i-Drive i11 and i12 devices as end-of-life and plan replacement with actively maintained hardware.
Remove the vendor APK from managed mobile devices to prevent credential extraction from corporate assets.
Restrict physical access to deployed devices and disable their wireless interfaces when not in use.

Patch Information

No patch is available. VulDB submission #510950 notes that the product maintainer could not be identified, and the product is assumed to be end-of-life. Organizations relying on these devices should migrate to supported alternatives.

Workarounds

Disable the pairing interface after initial configuration where the device supports it.
Operate the device in an isolated wireless environment that is not reachable from untrusted parties.
Enforce mobile application allow-listing on corporate devices to block installation of the vulnerable companion APK.

bash

# Example MDM policy snippet to block the vendor APK by package name
# (adjust package identifier to match the installed application)
mdm-cli app blocklist add --package com.i-drive.companion