CVE-2025-30124

State: Published
Severity: 9.8 Critical
Published: Jul 28, 2025
Updated: Jul 30, 2025
Reserved: Mar 17, 2025

Description

An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. When a new SD card is inserted into the dashcam, the existing password is written onto the SD card in cleartext automatically. An attacker with temporary access to the dashcam can switch the SD card to steal this password.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-312 Cleartext Storage of Sensitive Information

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/geo-chen/Marbella/
https://makagps.com/
https://geochen.medium.com/marbella-dashcam-ab40ca41adec
https://github.com/geo-chen/Marbella/blob/main/README.md#finding-4---cve-2025-30124-passwords-are-stored-in-plaintext-and-can-be-retrieved-with-physical-contact

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.