CVE-2025-11943 is a high severity flaw in the 70mai X200 dashcam, firmware up to 20251010: default credentials in the built in web server. NVD scores it 7.3. The record says the vendor did not respond to disclosure, so no fix is confirmed. Reduce exposure and check the vendor's channels.
What's affected
The record names the 70mai X200 and its firmware, versions up to 20251010. The affected component is the HTTP web server.
On fixed versions: the NVD description says the vendor was contacted early about the disclosure but did not respond in any way. I could not confirm a fixed firmware version from the record or the public write-up. Check the vendor's app and support pages for a newer firmware, and treat the device as vulnerable until you can verify.
The public write-up covers several findings across 70mai dashcams. This post covers only CVE-2025-11943.
How to check if you're exposed
There is no package to query. Work from the device.
- Find out which 70mai dashcams you or your staff use. The record names the X200.
- Open the firmware or about screen in the vendor's mobile app and read the version. Anything dated 20251010 or earlier is in the affected range.
- Think about who can reach the device. The record says the attack is remote. The public write-up describes related findings on 70mai dashcams that start from the device's own Wi-Fi network, so anyone who can join it is the audience to worry about.
What to do now
- Check for firmware newer than 20251010 in the vendor's app and install it if present.
- Change any default or shared credential you can on the device and its Wi-Fi network.
- Where the device lets you, turn off its Wi-Fi hotspot when you are not using the app.
- Do not leave sensitive recordings on the card longer than you need to.
- If the dashcam is part of a company fleet, add it to your asset list, record the firmware, and decide whether to replace it with a model whose vendor responds to security reports.
Why it matters
The description says the HTTP web server component can be manipulated in a way that leads to use of default credentials, and that the attack can be started remotely. The research write-up headline for this finding says a root password is exposed through an unauthenticated HTTP server. This post does not repeat any credential.
The weakness is CWE-1392, use of default credentials. A built in web server that hands out, or accepts, default credentials hands control of the device to anyone who can reach it. The CVSS vector rates impact as low on each axis, but a root level secret on a camera in a vehicle is a poor thing to leave exposed. The record says an exploit is public.
The record does not say this is exploited in the wild and it is not in the CISA Known Exploited Vulnerabilities catalog. It does say a public exploit exists and the vendor was silent, which is the combination that makes consumer devices hard to protect.
Quick check
Can I change the credentials myself?
The record does not say. Look in the vendor's app for a password or Wi-Fi setting and change whatever it allows, but verify with the vendor whether the root credential is user changeable.
Is a patch available?
I could not confirm one. The record says the vendor did not respond. Check for firmware newer than 20251010 and treat the device as exposed until you can verify.
Sources
Last reviewed: 19 October 2026.
