CVE-2025-30116: hella dr 820 firmware

csirt@kutim:~/threat-intel/cve/CVE-2025-30116

CVSS 7.5 · High EPSS 0,55%

Kerentanan Improper Authentication pada hella dr 820 firmware. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Remotely Dumping of Video Footage and the Live Video Stream can occur. It allows remote attackers to access and download recorded video footage from the SD card via port 9091. Additionally, attackers can connect to port 9092 to stream the live video feed by bypassing the challenge-response authentication mechanism. This exposes sensitive location and personal data.

Rincian

Terbit di NVD: 18 Maret 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-287: Improper Authentication
EPSS (30 hari): 0,55% peluang dieksploitasi; lebih tinggi dari 44,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
hella	dr 820 firmware	Semua versi

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/geo-chen/Hella advisory pihak ketiga
https://medium.com/@geochen/cve-draft-hella-driving-recorder-dr-820-ff8c4e2cca26 permissions required

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.