CyberSecurityBoard
Sponsor Register Login

Thinkware Dashcam Vulnerability Let Attackers Extract the Credentials in Plain-text

A series of critical vulnerabilities in Thinkware’s F800 Pro dashcam has revealed systemic security flaws, including the exposure of user credentials in plain text, default authentication bypasses, and insecure data storage practices. Microsoft’s January 2025 Patch Tuesday updates, which addressed critical Windows OLE flaws like CVE-2025-21298, demonstrate the contrasting responsiveness between enterprise software and IoT vendors—a disparity that leaves consumers disproportionately vulnerable. Cloud Account Compromise (CVE-2024–53614): A hardcoded AES-256 decryption key in the Thinkware Cloud APK (v4.3.46) allows man-in-the-middle attackers to decrypt login traffic, exposing cloud credentials and granting access to stored footage. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The cybersecurity community continues to reverse-engineer Thinkware’s firmware to identify additional attack surfaces, with findings expected at the Black Hat Asia 2025 conference. Researchers confirmed that the credentials remain accessible even after device reboots, posing a persistent risk to users who park vehicles in public or semi-secure locations.

This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 10 Mar 2025 09:50:21 +0000


Cyber News related to Thinkware Dashcam Vulnerability Let Attackers Extract the Credentials in Plain-text

CVE-2024-29204 - A heap-based buffer overflow vulnerability exists in Ivanti Avalanche prior to 6.4.3.A message sent to Avalanche's WLAvalancheService.exe on TCP port 1777 has the following structure:// be = big-endian strut msg { preamble pre; hp hdrpay; }; struct ...
10 months ago Tenable.com
Thinkware Dashcam Vulnerability Let Attackers Extract the Credentials in Plain-text - A series of critical vulnerabilities in Thinkware’s F800 Pro dashcam has revealed systemic security flaws, including the exposure of user credentials in plain text, default authentication bypasses, and insecure data storage practices. Microsoft’s ...
3 hours ago Cybersecuritynews.com CVE-2025-21298
CVE-2023-46217 - Multiple vulnerabilities exist in Ivanti Avalanche v6.4.1 WLAvalancheService.exe.CVE-2023-41727 - MuProperty type 100 stack-based buffer overflow (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)A message sent to WLAvalancheService.exe on TCP port 1777 ...
1 year ago Tenable.com
CVE-2023-46216 - Multiple vulnerabilities exist in Ivanti Avalanche v6.4.1 WLAvalancheService.exe.CVE-2023-41727 - MuProperty type 100 stack-based buffer overflow (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)A message sent to WLAvalancheService.exe on TCP port 1777 ...
1 year ago Tenable.com
CVE-2023-41727 - Multiple vulnerabilities exist in Ivanti Avalanche v6.4.1 WLAvalancheService.exe.CVE-2023-41727 - MuProperty type 100 stack-based buffer overflow (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)A message sent to WLAvalancheService.exe on TCP port 1777 ...
1 year ago Tenable.com
Credentials are Still King: Leaked Credentials, Data Breaches and Dark Web Markets - Infostealers infect computers, steal all of the credentials saved in the browser along with active session cookies and other data, then export it back to command and control infrastructure before, in some cases, self-terminating. This article will ...
1 year ago Bleepingcomputer.com
It's not a bug, it is a feature - Update: I decided that after two years and unfortunately no positive results from BlackVue publishing this post was in the public interest especially with the rise in car crime, while not directly related to BlackVue, I figured it best be brought to ...
11 months ago Blog.zsec.uk
Content Credentials Show Promise, But Ecosystem Still Young - It's a good start, but an end-to-end workflow requires more: Cameras or smartphones to generate signed images, support for Content Credentials in a wide variety of image-editing software, and the ability to view authenticated metadata on social ...
2 weeks ago Darkreading.com
Ivanti Avalanche Multiple Vulnerabilities - Multiple vulnerabilities exist in Ivanti Avalanche v6.4.1 WLAvalancheService. CVE-2023-41727 - MuProperty type 100 stack-based buffer overflow. Exe copies user-supplied data to a fixed-size stack-based buffer. An unauthenticated remote attacker can ...
1 year ago Tenable.com CVE-2023-41727
Arcserve Unified Data Protection 9.2 Multiple Vulnerabilities - An authentication bypass vulnerability exists in edge-app-base-webui. The doLogin() method fetches the correct UUID, so the login would succeed. An unauthenticated remote attacker can exploit this vulnerability by sending a POST HTTP message without ...
11 months ago Tenable.com CVE-2024-0800
Researchers Uncover Simple Technique to Extract ChatGPT Training Data - Can getting ChatGPT to repeat the same word over and over again cause it to regurgitate large amounts of its training data, including personally identifiable information and other data scraped from the Web? The answer is an emphatic yes, according to ...
1 year ago Darkreading.com
CVE-2025-2119 - A vulnerability was found in Thinkware Car Dashcam F800 Pro up to 20250226. It has been declared as problematic. This vulnerability affects unknown code of the component Device Registration Handler. The manipulation leads to use of default ...
1 day ago
What happens when you accidentally leak your AWS API keys? - My situation had no ill consequences, but it could have if I had used my actual email for the script or if my project was bigger and I had used AWS or another cloud provider and hardcoded those credentials. In a later class I did learn how to safely ...
11 months ago Isc.sans.edu
CVE-2025-2122 - A vulnerability classified as problematic was found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected by this vulnerability is an unknown functionality of the component Connection Handler. The manipulation leads to denial of service. The ...
1 day ago
CVE-2025-2121 - A vulnerability classified as critical has been found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected is an unknown function of the component File Storage. The manipulation leads to improper access controls. The attack can only be done ...
1 day ago
CVE-2025-2120 - A vulnerability was found in Thinkware Car Dashcam F800 Pro up to 20250226. It has been rated as problematic. This issue affects some unknown processing of the file /tmp/hostapd.conf of the component Configuration File Handler. The manipulation leads ...
1 day ago
OpenAI AI Text Classifier: Detect AI-Generated Text - OpenAI has released an AI text classifier that attempts to detect whether input content was generated using artificial intelligence tools like ChatGPT. The AI Text Classifier is a fine-tuned GPT model that predicts how likely it is that a piece of ...
2 years ago Bleepingcomputer.com
What is an email signature? - An email signature - or signature block or signature file - is the block of text that appears at the end of an email message that provides more information about the sender. This can include details such as the sender's full name, occupation or job ...
1 year ago Techtarget.com
Best of 2023: Combo Lists & the Dark Web: Understanding Leaked Credentials - In today's interconnected, cloud-based world, user credentials are the keys that grant entry to the house that stores an organization's digital treasure. Just as burglars pick the lock on a physical house, cybercriminals use stolen credentials to ...
1 year ago Securityboulevard.com
What to do when receiving unprompted MFA OTP codes - Receiving an unprompted one-time passcode sent as an email or text should be a cause for concern as it likely means your credentials have been stolen. One of the initial components of a cyberattack is the theft of legitimate credentials to corporate ...
1 year ago Bleepingcomputer.com
361 million stolen accounts leaked on Telegram added to HIBP - A massive trove of 361 million email addresses from credentials stolen by password-stealing malware, in credential stuffing attacks, and from data breaches was added to the Have I Been Pwned data breach notification service, allowing anyone to check ...
8 months ago Bleepingcomputer.com
CVE-2024-45004 - In the Linux kernel, the following vulnerability has been resolved: ...
5 months ago
Defusing the threat of compromised credentials - In the end, some employees who were targeted approved the MFA requests and the attackers gained access to these accounts. Most phishing attacks employ similar social engineering techniques to trick users into turning over their credentials. Attackers ...
11 months ago Feedpress.me
CVE-2024-57838 - In the Linux kernel, the following vulnerability has been resolved: s390/entry: Mark IRQ entries to fix stack depot warnings The stack depot filters out everything outside of the top interrupt context as an uninteresting or irrelevant part of the ...
1 month ago Tenable.com
CVE-2023-29055 - In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials. When the kylin service runs over HTTP (or other plain text ...
1 year ago

Latest Cyber News


Cyber Trends (last 7 days)


Trending Cyber News (last 7 days)