CVE-2024-56897

Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands. API commands can also be made to make unauthorized modifications to the device settings, such as disabling recording, disabling sounds, factory reset.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.75% chance of exploitation in the next 30 days, 54th percentile

Published

2025-02-24

Updated

2025-03-03

Proof-of-concept exploits (1)

• https://geochen.medium.com/cve-2024-56897-yi-car-dashcam-39304a4b21b4

Security advisories

• geo-chen/YI-Smart-Dashcam

References

• CVE Record
• NVD entry