CVE-2025-30139

An issue was discovered on G-Net Dashcam BB GONX devices. Default credentials for SSID cannot be changed. It broadcasts a fixed SSID with default credentials that cannot be changed. This allows any nearby attacker to connect to the dashcam's network without restriction. Once connected, an attacker can sniff on connected devices such as the user's smartphone. The SSID is also always broadcasted.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/geo-chen/GNET	Third Party Advisory
https://www.gnetsystem.com/eng/product/list?viewMode=view&idx=246&ca_id=0201	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:gnetsystem:g-onx_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:gnetsystem:g-onx:-:*:*:*:*:*:*:*

History

01 Jul 2025, 21:04

Type	Values Removed	Values Added
First Time		Gnetsystem g-onx Gnetsystem g-onx Firmware Gnetsystem
References	~~() https://github.com/geo-chen/GNET -~~	() https://github.com/geo-chen/GNET - Third Party Advisory
References	~~() https://www.gnetsystem.com/eng/product/list?viewMode=view&idx=246&ca_id=0201 -~~	() https://www.gnetsystem.com/eng/product/list?viewMode=view&idx=246&ca_id=0201 - Product
CPE		cpe:2.3:o:gnetsystem:g-onx_firmware:-:::::::* cpe:2.3:h:gnetsystem:g-onx:-:::::::*

25 Mar 2025, 16:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
CWE		CWE-1392
Summary		(es) Se detectó un problema en los dispositivos G-Net Dashcam BB GONX. Las credenciales predeterminadas del SSID no se pueden cambiar. Transmite un SSID fijo con credenciales predeterminadas que no se pueden cambiar. Esto permite que cualquier atacante cercano se conecte a la red de dashcam sin restricciones. Una vez conectado, un atacante puede rastrear dispositivos conectados, como el smartphone del usuario. El SSID también se transmite siempre.

18 Mar 2025, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-18 20:15

Updated : 2025-07-01 21:04

NVD link : CVE-2025-30139

Mitre link : CVE-2025-30139

CVE.ORG link : CVE-2025-30139

JSON object : View

Products Affected

gnetsystem

g-onx_firmware
g-onx

CWE

CWE-1392

Use of Default Credentials

{"id": "CVE-2025-30139", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-03-18T20:15:26.597", "references": [{"url": "https://github.com/geo-chen/GNET", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.gnetsystem.com/eng/product/list?viewMode=view&idx=246&ca_id=0201", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-1392"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on G-Net Dashcam BB GONX devices. Default credentials for SSID cannot be changed. It broadcasts a fixed SSID with default credentials that cannot be changed. This allows any nearby attacker to connect to the dashcam's network without restriction. Once connected, an attacker can sniff on connected devices such as the user's smartphone. The SSID is also always broadcasted."}, {"lang": "es", "value": "Se detect\u00f3 un problema en los dispositivos G-Net Dashcam BB GONX. Las credenciales predeterminadas del SSID no se pueden cambiar. Transmite un SSID fijo con credenciales predeterminadas que no se pueden cambiar. Esto permite que cualquier atacante cercano se conecte a la red de dashcam sin restricciones. Una vez conectado, un atacante puede rastrear dispositivos conectados, como el smartphone del usuario. El SSID tambi\u00e9n se transmite siempre."}], "lastModified": "2025-07-01T21:04:40.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:gnetsystem:g-onx_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2120C516-F31B-406B-BC9A-4397D10EDDA3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:gnetsystem:g-onx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D2E9038F-6802-4704-805F-FC76FD268CCE"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}

9.8 /10