CVE-2025-6528: 70mai M300 Authentication Bypass Vulnerability

CVE-2025-6528 is an authentication bypass flaw in 70mai M300 Firmware affecting RTSP live video stream endpoints. Attackers on the local network can access video streams without proper authentication. This article covers technical details, affected firmware versions, security impact, and available mitigation strategies.

CVE-2025-6528 Overview

CVE-2025-6528 is an improper authentication vulnerability [CWE-287] affecting the 70mai M300 dashcam firmware through build 20250611. The flaw exists in the Real-Time Streaming Protocol (RTSP) endpoint /livestream/12, which serves the device's live video feed without enforcing authentication. An attacker on the same local network segment can connect to this endpoint and retrieve the live camera stream. The vendor was contacted before public disclosure but did not respond. A public write-up of the finding is available on GitHub.

Critical Impact
Adjacent-network attackers can access the M300 dashcam's live video stream without credentials, exposing the driver's surroundings and in-cabin activity.

Affected Products

70mai M300 dashcam hardware
70mai M300 firmware versions up to and including 20250611
Devices exposing the RTSP /livestream/12 endpoint on the local network

Discovery Timeline

2025-06-23 - CVE-2025-6528 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-6528

Vulnerability Analysis

The 70mai M300 exposes an RTSP service on its local network interface to support live video preview from the companion mobile application. The endpoint /livestream/12 handles the request for the live video stream but does not require the caller to present valid credentials. Any client that can reach the device over the local network can issue an RTSP DESCRIBE and PLAY sequence and receive the video feed.

The vulnerability is classified under CWE-287 (Improper Authentication). The exploit has been publicly disclosed, which lowers the barrier for opportunistic abuse on shared Wi-Fi networks such as hotel, home, or vehicle hotspots.

Root Cause

The root cause is a missing authentication check on the RTSP stream handler. The device firmware serves the /livestream/12 resource in response to unauthenticated RTSP requests, treating adjacent-network reachability as an implicit trust boundary. No token, session, or credential exchange is required before the stream begins.

Attack Vector

Exploitation requires the attacker to be on the same local network as the dashcam, for example a shared Wi-Fi access point, a compromised router, or the vehicle's mobile hotspot. The attacker discovers the M300 by scanning for its RTSP port, then connects a standard RTSP client to rtsp://<device-ip>/livestream/12. No user interaction on the dashcam side is needed. Refer to the public technical write-up on GitHub for the request sequence.

Detection Methods for CVE-2025-6528

Indicators of Compromise

Unexpected inbound RTSP sessions (typically TCP 554 or the device's configured RTSP port) to the M300's local IP address.
RTSP DESCRIBE or PLAY requests referencing the path /livestream/12 from clients other than the paired 70mai mobile application.
Sustained outbound streaming traffic from the dashcam to an unfamiliar host on the same subnet.

Detection Strategies

Passively inspect wireless or LAN traffic for RTSP handshakes to the dashcam's IP, correlating source MAC addresses against the list of authorized devices.
Alert on any RTSP session to the M300 that originates from a device not enrolled with the 70mai companion application.
Use network access control logs to flag new or unknown clients associating with the same access point that the dashcam uses.

Monitoring Recommendations

Enable client isolation on the Wi-Fi network hosting the dashcam so peer devices cannot reach RTSP ports.
Log DHCP leases and ARP activity on the subnet to identify unauthorized devices that could reach the M300.
Monitor router or firewall logs for RTSP traffic patterns matching the /livestream/12 path.

How to Mitigate CVE-2025-6528

Immediate Actions Required

Place the 70mai M300 on an isolated Wi-Fi network or VLAN that only trusted client devices can join.
Enable AP client isolation so that other devices on the same SSID cannot initiate RTSP connections to the dashcam.
Disable the live-stream feature when it is not actively needed, and power the dashcam down when leaving the vehicle in shared environments.

Patch Information

No vendor patch is available. The vendor was contacted prior to disclosure and did not respond, according to the public advisory. Monitor the VulDB entry for CVE-2025-6528 and the 70mai support channels for future firmware updates that address the missing authentication check.

Workarounds

Restrict RTSP traffic (default port 554) on the hosting network using firewall rules that only permit the paired mobile device.
Use a dedicated, WPA2/WPA3-protected SSID for the dashcam and avoid connecting it to public or shared hotspots.
Consider retiring the device from sensitive use cases until the vendor issues a firmware update that enforces authentication on /livestream/12.

bash

# Example: block adjacent access to the dashcam's RTSP port on a Linux-based router
iptables -I FORWARD -p tcp --dport 554 -d <M300_IP> -j DROP
iptables -I FORWARD -p tcp --dport 554 -d <M300_IP> \
    -m mac --mac-source <PAIRED_PHONE_MAC> -j ACCEPT