Vulnerability · Published Oct 19, 2025 · Assigned by VulDB

CVE-2025-1194270mai X200 Pairing missing authentication

High 7.3

In plain English

A high-severity missing authentication in X200 from 70mai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)1.1%top 34.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in 70mai X200 up to 20251010. Affected is an unknown function of the component Pairing. Executing manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
70mai	X200	20251010

Weakness: CWE-306, CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R

References

VDB-329021 | 70mai X200 Pairing missing authentication vdb-entry
VDB-329021 | CTI Indicators (IOB, IOC) signature, permissions-required
Submit #672520 | 70mai dash cam omni x200 Improper Access Controls third-party-advisory
https://github.com/geo-chen/70mai/blob/main/README.md#finding-9-bypass-device-pairing-of-70mai-dashcam-omni-x200 broken-link, exploit