CVE-2025-30114
Published: 18 March 2025
Summary
CVE-2025-30114 is a critical-severity Improper Authentication (CWE-287) vulnerability in Hella Dr 820 Firmware. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 8.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-3 (Device Identification and Authentication).
Deeper analysis
CVE-2025-30114 affects the Forvia Hella HELLA Driving Recorder DR 820, a dashcam device, where the pairing mechanism can be bypassed due to its sole reliance on the connecting device's MAC address for authentication. This improper authentication design (CWE-287) allows attackers to spoof the MAC address after obtaining it via network scanning, granting unauthorized access to the device's features. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high severity with network accessibility, low complexity, and significant impacts on confidentiality and integrity.
Any attacker with network access to the device can exploit this vulnerability without privileges or user interaction. By performing a network scan to identify the legitimate paired device's MAC address and then spoofing it on their own device, the attacker bypasses pairing entirely and gains full control over the dashcam, potentially accessing recorded footage or other sensitive functions.
Further details, including potential proof-of-concept demonstrations, are available in researcher publications such as the GitHub repository at https://github.com/geo-chen/Hella and the Medium article at https://medium.com/@geochen/cve-draft-hella-driving-recorder-dr-820-ff8c4e2cca26. No specific patches or vendor mitigations are detailed in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6685
Vulnerability details
An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Bypassing of Device Pairing can occur. The pairing mechanism relies solely on the connecting device's MAC address. By obtaining the MAC address through network scanning and spoofing…
more
it, an attacker can bypass the authentication process and gain full access to the dashcam's features without proper authorization.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
MAC spoofing bypasses pairing to grant full unauthorized access, facilitating data collection from system/removable media including video streams and recordings (T1005, T1025, T1082, T1083, T1125) and destructive actions like file deletion and wiping (T1070.004, T1485, T1561.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires authenticating devices using mechanisms stronger than spoofable MAC addresses before allowing connections to the dashcam, preventing unauthorized pairing bypass.
Enforces access control policies that restrict dashcam features to only properly authenticated devices, blocking full unauthorized access gained via MAC spoofing.
Manages authenticators to ensure sufficient strength and protection against spoofing, such as prohibiting sole reliance on MAC addresses for device pairing.