CVE-2025-11942 is a high severity flaw in the 70mai X200 dashcam, firmware up to 20251010: missing authentication in the pairing step. NVD scores it 7.3. The record says the vendor did not respond to disclosure, so no fix is confirmed. Reduce exposure and check the vendor's channels.
What's affected
The record names the 70mai X200 and its firmware, versions up to 20251010. The affected component is the pairing component.
On fixed versions: the NVD description says the vendor was contacted early about the disclosure but did not respond in any way. I could not confirm a fixed firmware version from the record or the public write-up. Check the vendor's app and support pages for a newer firmware, and treat the device as vulnerable until you can verify.
The public write-up covers several findings across 70mai dashcams. This post covers only CVE-2025-11942.
How to check if you're exposed
There is no package to query. Work from the device.
- Find out which 70mai dashcams you or your staff use. The record names the X200.
- Open the firmware or about screen in the vendor's mobile app and read the version. Anything dated 20251010 or earlier is in the affected range.
- Think about who can reach the device. The record says the attack is remote. The public write-up describes related findings on 70mai dashcams that start from the device's own Wi-Fi network, so anyone who can join it is the audience to worry about.
What to do now
- Check for firmware newer than 20251010 in the vendor's app and install it if present.
- Change any default or shared credential you can on the device and its Wi-Fi network.
- Where the device lets you, turn off its Wi-Fi hotspot when you are not using the app.
- Do not leave sensitive recordings on the card longer than you need to.
- If the dashcam is part of a company fleet, add it to your asset list, record the firmware, and decide whether to replace it with a model whose vendor responds to security reports.
Why it matters
The description says an unknown function in the Pairing component can be manipulated, which leads to missing authentication, and that the attack can be launched remotely. The research write-up titles the finding as a bypass of device pairing on the 70mai Dashcam Omni X200. Pairing is supposed to prove that the person connecting is the owner.
The weaknesses are CWE-287 (improper authentication) and CWE-306 (missing authentication for a critical function). When the device skips that proof, anyone who can reach its network interface can act as a paired phone. The CVSS vector rates the impact as low across confidentiality, integrity and availability, which is why the score stops at 7.3, but a dashcam holds footage of where you drive, so even a low rating can carry privacy weight.
The record does not say this is exploited in the wild and it is not in the CISA Known Exploited Vulnerabilities catalog. It does say a public exploit exists and the vendor was silent, which is the combination that makes consumer devices hard to protect.
Quick check
Does this need physical access to the dashcam?
The CVE says the attack can be launched remotely. The write-up concerns reaching the device over its own network, so in practice an attacker needs to be within range of that network. Check the write-up for the exact conditions.
Is there a patch?
I could not confirm one. The record says the vendor did not respond to the researcher. Check the vendor's app and website for firmware newer than 20251010.
Sources
Last reviewed: 19 October 2026.
