CVE-2025-2120

Executive Summary

CVE-2025-2120 is a vulnerability in the Thinkware Car Dashcam F800 Pro firmware up to version 20250226. The issue involves cleartext storage of sensitive configuration data in the file /tmp/hostapd.conf. This file, which is part of the device's Configuration File Handler, contains Wi-Fi credentials and other network parameters in plaintext. An attacker with physical access to the device can read this file, extracting credentials that could be used to compromise the dashcam's Wi-Fi network or pivot to other devices on the same network. The vendor has not responded to disclosure, and no patch is available.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a proprietary embedded device.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the vulnerability details, a more realistic assessment would be:

• Attack Vector (AV): Physical (AV:P) – Requires physical access to the device.
• Attack Complexity (AC): Low (AC:L) – No special conditions required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality (C): High (C:H) – Exposes sensitive Wi-Fi credentials.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): None (A:N) – No impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Estimated Score: 4.6 (Medium)

Threat Level: Medium. The attack requires physical access, but the impact is significant as it exposes credentials that could be reused on other networks.

Deep Dive & Mechanics

The vulnerability lies in the way the Thinkware F800 Pro dashcam handles its Wi-Fi configuration. The file /tmp/hostapd.conf is used by the hostapd daemon to manage the device's Wi-Fi access point. This file contains the SSID and pre-shared key (PSK) in plaintext. The file is stored in /tmp, which is a temporary filesystem, but it persists during the device's runtime and can be read by any process or user with local access.

Root Cause: The dashcam firmware does not encrypt or restrict access to the configuration file. The file permissions are likely set to world-readable, allowing any process or attacker with physical access to read it.

Attack Vector: An attacker with physical access to the dashcam (e.g., by removing the SD card or connecting via USB) can mount the device's filesystem and read /tmp/hostapd.conf. Alternatively, if the device has a debug interface (e.g., UART), the attacker can access a shell and read the file directly.

Impact: The exposed Wi-Fi credentials can be used to connect to the dashcam's Wi-Fi network, potentially allowing the attacker to intercept video streams, modify settings, or use the dashcam as a pivot point to attack other devices on the same network.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable state.

Vulnerable Code (Conceptual): The firmware likely writes the configuration file without any encryption or access control. For example, in a shell script or C program:

echo "ssid=MyDashcam" > /tmp/hostapd.conf
echo "wpa_passphrase=secret123" >> /tmp/hostapd.conf
chmod 644 /tmp/hostapd.conf

Patched Code (Hypothetical): A patch would involve encrypting the sensitive fields or restricting file permissions:

# Encrypt the passphrase before writing
encrypted_pass=$(echo "secret123" | openssl enc -aes-256-cbc -pass pass:device_key)
echo "wpa_passphrase=$encrypted_pass" >> /tmp/hostapd.conf
chmod 600 /tmp/hostapd.conf

Additionally, the firmware should ensure that the file is only readable by the hostapd process.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Physical access to a Thinkware F800 Pro dashcam.
• A computer with a microSD card reader or UART adapter.

Steps:

1. Remove the microSD card from the dashcam.
2. Insert the microSD card into a computer.
3. Mount the card and navigate to the root filesystem (if accessible) or use a UART connection to get a shell.
4. Read the file:

   cat /tmp/hostapd.conf
   

5. Extract the SSID and passphrase from the output:

   ssid=MyDashcam
   wpa_passphrase=secret123
   

6. Use the credentials to connect to the dashcam's Wi-Fi network.

Example Output:

$ cat /tmp/hostapd.conf
interface=wlan0
driver=nl80211
ssid=Thinkware_F800_Pro
hw_mode=g
channel=6
wpa=2
wpa_passphrase=MySecurePass123
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP

Blue Team (Defense & Detection)

Detection:

• Monitor for unauthorized physical access to dashcams.
• Use file integrity monitoring (FIM) to detect changes to /tmp/hostapd.conf.
• Enable logging on the dashcam to record access attempts.

Mitigation:

• Change the default Wi-Fi password immediately after installation.
• Disable Wi-Fi if not needed.
• Use a VPN or separate network for dashcam traffic.
• Apply firmware updates when available.

Indicators of Compromise (IOCs)

• File Path: /tmp/hostapd.conf
• File Content: Plaintext Wi-Fi credentials (SSID and passphrase).
• Network Traffic: Unauthorized connections to the dashcam's Wi-Fi network.
• Physical Evidence: Tampering with the dashcam's SD card or UART interface.

Detection Engineering

YARA Rule

rule Thinkware_Credentials_Exposure {
    meta:
        description = "Detects cleartext Wi-Fi credentials in Thinkware F800 Pro dashcam"
        author = "Valters IT"
        date = "2025-02-27"
        reference = "CVE-2025-2120"
    strings:
        $ssid = "ssid=" ascii wide
        $passphrase = "wpa_passphrase=" ascii wide
    condition:
        $ssid and $passphrase
}

Sigma Rule

title: Thinkware F800 Pro Cleartext Credentials
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects access to /tmp/hostapd.conf containing plaintext credentials
author: Valters IT
date: 2025-02-27
logsource:
    category: file_access
    product: linux
detection:
    selection:
        TargetFilename: '/tmp/hostapd.conf'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: high

Suricata Rule

alert tcp any any -> any any (msg:"Thinkware F800 Pro Credential Exposure"; content:"wpa_passphrase="; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Change the Wi-Fi password on the dashcam to a strong, unique password.
2. Disable Wi-Fi if not required.
3. Restrict physical access to the device.

Long-term Fix:

• The vendor (Thinkware) must release a firmware update that encrypts the configuration file or restricts file permissions.
• Until a patch is available, users should consider the device compromised if physical access is possible.

Workaround:

• Use a separate, isolated network for the dashcam.
• Monitor for unauthorized connections.

Valters IT