Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5 results
Mar 18, 2025An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820.CVE-2025-30117 · Other software · Hella · reported by MITREHigh 7.3
An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. After bypassing the device pairing, an attacker can obtain sensitive user and vehicle information through the settings interface. Remote attackers can modify power management settings, disable recording, delete stored footage, and turn off battery protection, leading to potential denial-of-service conditions and vehicle battery drainage.
- Product
- DR 820 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820.CVE-2025-30116 · Other software · Hella · reported by MITREHigh 7.5
An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Remotely Dumping of Video Footage and the Live Video Stream can occur. It allows remote attackers to access and download recorded video footage from the SD card via port 9091. Additionally, attackers can connect to port 9092 to stream the live video feed by bypassing the challenge-response authentication mechanism. This exposes sensitive location and personal data.
- Product
- DR 820 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820.CVE-2025-30115 · Other software · Hella · reported by MITRECritical 9.8
An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Default Credentials Cannot Be Changed. It uses a fixed default SSID and password ("qwertyuiop"), which cannot be modified by users. The SSID is continuously broadcast, allowing unauthorized access to the device network.
- Product
- DR 820 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820.CVE-2025-30114 · Other software · Hella · reported by MITRECritical 9.1
An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Bypassing of Device Pairing can occur. The pairing mechanism relies solely on the connecting device's MAC address. By obtaining the MAC address through network scanning and spoofing it, an attacker can bypass the authentication process and gain full access to the dashcam's features without proper authorization.
- Product
- DR 820 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820.CVE-2025-30113 · Other software · Hella · reported by MITRECritical 9.8
An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Hardcoded Credentials exist in the APK for Ports 9091 and 9092. The dashcam's Android application contains hardcoded credentials that allow unauthorized access to device settings through ports 9091 and 9092. These credentials, stored in cleartext, can be exploited by an attacker who gains access to the dashcam's network.
- Product
- DR 820 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.