CVE-2025-30124

Executive Summary

CVE-2025-30124 exposes a critical cleartext credential storage vulnerability in Marbella KR8s Dashcam FF firmware version 2.0.8. When a new SD card is inserted, the device automatically writes the existing Wi-Fi or device password onto the SD card in plaintext. An attacker with temporary physical access can swap the SD card to exfiltrate this password, enabling unauthorized network access or device takeover. The vulnerability is currently unpatched, and no public exploit code exists. The CVSS score is 0.0 due to incomplete NVD data, but the actual risk is moderate given the physical access requirement.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded IoT device (Marbella KR8s Dashcam). No supply chain package security implications apply.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Physical (AV:P) – Requires physical access to the dashcam.
• Attack Complexity (AC): Low (AC:L) – No special conditions needed.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – Exploit does not cross trust boundaries.
• Confidentiality (C): High (C:H) – Password is fully disclosed.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): None (A:N) – No denial of service.

Base Score: 4.6 (Medium) – Physical access required, but impact is high for confidentiality.

Threat Level: Medium. Exploitation requires physical proximity, but the password can be used for lateral movement or network compromise.

Deep Dive & Mechanics

The vulnerability resides in the SD card management logic of the Marbella KR8s Dashcam firmware (version 2.0.8). When a new SD card is inserted, the device automatically writes the current Wi-Fi password (or device admin password) to a file on the SD card in cleartext. This is likely intended for backup or configuration transfer, but the lack of encryption or access control makes it exploitable.

Attack Flow:

1. Attacker gains temporary physical access to the dashcam (e.g., during parking, valet, or theft).
2. Attacker removes the existing SD card and inserts a blank SD card.
3. The dashcam detects the new card and writes the password to it (e.g., in a file like config.txt or password.txt).
4. Attacker retrieves the SD card and reads the cleartext password.
5. The password can then be used to connect to the dashcam’s Wi-Fi network or access its web interface.

Root Cause: The firmware does not encrypt or protect the password when writing to external storage. CWE-312 (Cleartext Storage of Sensitive Information) applies.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is in the SD card initialization routine. A hypothetical patch would encrypt the password before writing to the SD card or require user confirmation.

Vulnerable (pseudocode):

void on_sd_insert() {
    char password[64];
    get_wifi_password(password);
    FILE *fp = fopen("/mnt/sd/config.txt", "w");
    fprintf(fp, "password=%s", password);
    fclose(fp);
}

Patched (hypothetical):

void on_sd_insert() {
    char password[64];
    char encrypted[128];
    get_wifi_password(password);
    encrypt(password, encrypted, device_key);
    FILE *fp = fopen("/mnt/sd/config.enc", "w");
    fprintf(fp, "password=%s", encrypted);
    fclose(fp);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Physical access to a Marbella KR8s Dashcam (firmware 2.0.8).
• A blank SD card (FAT32 formatted).

Steps:

1. Power on the dashcam and wait for it to boot.
2. Remove the existing SD card (if any).
3. Insert the blank SD card.
4. Wait 10–30 seconds for the dashcam to write the password.
5. Remove the SD card and insert it into a computer.
6. Read the file (e.g., config.txt or password.txt) to obtain the cleartext password.

Example command to read the file:

cat /media/sd_card/config.txt

Blue Team

Detection:

• Monitor for unauthorized SD card insertions/removals via physical security logs.
• Use network monitoring to detect new devices connecting to the dashcam’s Wi-Fi after a password change.

Mitigation:

• Physically secure the dashcam (e.g., lockable mount, tamper-evident seals).
• Disable automatic password writing if possible (check firmware settings).
• Use a strong, unique password and change it regularly.

Indicators of Compromise (IOCs)

• File: config.txt or password.txt on an SD card containing cleartext password.
• Event: SD card insertion/removal logs on the dashcam (if available).
• Network: New Wi-Fi client connecting to the dashcam’s SSID shortly after physical access.

Detection Engineering

YARA Rule

rule CVE_2025_30124_Cleartext_Password {
    meta:
        description = "Detects cleartext password files from Marbella KR8s Dashcam"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-30124"
    strings:
        $password = "password=" ascii wide nocase
        $wifi = "wifi" ascii wide nocase
        $config = "config.txt" ascii wide nocase
    condition:
        $password and ($wifi or $config)
}

Sigma Rule

title: Marbella KR8s Dashcam Cleartext Password Write
id: 8a3f7c2e-9b1d-4e5f-8c7a-2d3e4f5a6b7c
status: experimental
description: Detects the creation of a cleartext password file on an SD card by Marbella KR8s Dashcam
author: Valters IT
date: 2025-04-01
logsource:
    product: linux
    category: file_event
detection:
    selection:
        TargetFilename|endswith: 'config.txt'
        TargetFilename|contains: '/sd/'
    condition: selection
falsepositives:
    - Legitimate configuration backups (if encrypted)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-30124 Marbella Dashcam Password Exfiltration"; flow:to_server,established; content:"password="; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Physically secure the dashcam to prevent unauthorized SD card access.
2. Disable automatic password writing if the firmware allows (check settings).
3. Use a strong, unique Wi-Fi password and change it regularly.

Long-Term Fix:

• Vendor must release a firmware update that encrypts the password before writing to SD card or requires user confirmation.
• Implement CWE-312 mitigation: never store sensitive data in cleartext on removable media.

Workaround:

• Remove the SD card when not needed, or use a dummy SD card that does not trigger the write.

Valters IT