Forvia Hella HELLA Driving Recorder DR 820 on Android Setting hard-coded credentials

Summaryinfo

A vulnerability was found in Forvia Hella HELLA Driving Recorder DR 820 on Android. It has been rated as critical. Affected is an unknown function of the component Setting Handler. This manipulation causes hard-coded credentials. This vulnerability appears as CVE-2025-30113. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Forvia Hella HELLA Driving Recorder DR 820 on Android (version unknown). It has been declared as critical. Affected by this vulnerability is an unknown function of the component Setting Handler. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. The CWE definition for the vulnerability is CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. As an impact it is known to affect confidentiality. The summary by CVE is:

An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Hardcoded Credentials exist in the APK for Ports 9091 and 9092. The dashcam's Android application contains hardcoded credentials that allow unauthorized access to device settings through ports 9091 and 9092. These credentials, stored in cleartext, can be exploited by an attacker who gains access to the dashcam's network.

The advisory is shared at medium.com. This vulnerability is known as CVE-2025-30113 since 03/17/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1110.001 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-6686). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Android App Software

Vendor

• Forvia Hella

Name

• HELLA Driving Recorder DR 820

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion