CVE-2024-56897

9.8 criticalEPSS 0.7%

Critical (9.8) in yitechnology yi car dashcam firmware. EPSS 0.7% chance of exploitation in the next 30 days.

Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands. API commands can also be made to make unauthorized modifications to the device settings, such as disabling recording, disabling sounds, factory reset.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2025-02-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

yitechnology:yi_car_dashcam_firmware

References

https://geochen.medium.com/cve-2024-56897-yi-car-dashcam-39304a4b21b4
https://github.com/geo-chen/YI-Smart-Dashcam/
https://yitechnology.com.sg/products/dash-camera/

Check your stack JSON