CVE-2024-56897 is a critical severity flaw (CVSS 9.8) in the HTTP server of the YI Car Dashcam, firmware v3.88. Improper access control allows unrestricted file downloads, uploads and API commands. We could not confirm a fixed version, so check with the vendor and limit who can reach the device.
What's affected
The record describes improper access control in the HTTP server in YI Car Dashcam v3.88. The listed products are the YI Car Dashcam and its firmware. It says the flaw allows unrestricted file downloads, uploads and API commands, and that the API commands can make unauthorized changes to settings, such as disabling recording, disabling sounds and factory reset.
The record gives no fixed version. The references are the researcher's write-up, a GitHub repository for the research and the vendor's product page, which we could not use to confirm a fix. We could read the repository page but it adds little beyond the record, and the write-up on Medium could not be loaded. So there is no vendor advisory we can quote. Treat v3.88 as affected, and treat later firmware as unconfirmed until the vendor says otherwise.
How to check if you're exposed
For a consumer device there is no package manager to query, so check the basics.
- Read the firmware version in the dashcam's companion app or settings screen, and see whether it reads v3.88.
- Find out how the device is reached. A dashcam usually runs its own Wi-Fi network for the phone app. Anyone in range who joins that network may be able to reach the HTTP server, depending on the password you set.
- Check whether you changed the default Wi-Fi password. A device on a default password is open to anyone who knows or guesses it.
- Check whether the dashcam is ever connected to a shared network, such as a home or office network, where other devices could reach it.
If you manage a fleet of these devices, for example in company vehicles, make a list by vehicle and firmware version.
What to do now
- Check the vendor's support and download pages for firmware newer than v3.88, and install any update you find.
- Change the device's Wi-Fi password to a long, unique one, if the device allows it.
- Turn off the device's Wi-Fi access point when you do not need to transfer footage, if the settings allow it.
- Do not connect the dashcam to your home, office or fleet network.
- Copy important footage off the device on a schedule, since the record mentions unauthorized changes up to a factory reset.
- For fleets, ask the vendor in writing about a fix and keep the answer with your records.
Why it matters
The record classes this as CWE-434, which covers unrestricted upload of dangerous file types, and describes it as improper access control. The common thread is that the device's HTTP server does what it is asked without checking who is asking. File download, upload and control commands are all open.
For a dashcam, the harm is practical. Someone near the vehicle who can join its network could take recorded video, change settings, turn off recording or wipe the device. The vector in the record shows network access, low complexity and no privileges, which gives the 9.8 score. Whether an attacker is in range is a physical question that a scoring formula does not capture. The KEV flag in the record is false. Embedded devices often get patched slowly or never, so reduce exposure on your side rather than wait.
Quick check
Is there a fixed firmware for CVE-2024-56897?
We could not confirm one from the sources. Check the vendor's pages for the current firmware and ask the vendor directly.
Does an attacker need to be on the internet?
The vector says network access. For a dashcam that usually means being able to reach its Wi-Fi network or the network it is joined to.
Sources
Last reviewed: 19 October 2026.
