Improper Access Control in YI Car Dashcam Affects User Security
CVE-2024-56897
9.8CRITICAL
What is CVE-2024-56897?
The YI Car Dashcam v3.88 has a vulnerability that stems from improper access control within its HTTP server. This flaw allows attackers to perform unrestricted file downloads and uploads, and execute unauthorized API commands. Consequently, unauthorized modifications to critical device settings may occur, enabling potential actions such as disabling recording features, muting audio, and even triggering factory resets. Users of this device are advised to monitor for any unusual behavior and consider updates to mitigate the risk.