Viidure dashcam platform exposes live footage and firmware through a publicly readable bucket

Every copy of the Android app holds the storage credentials, because they are compiled into it ^[1]. The open bucket also stores the platform's application packages next to the records and footage ^[4]. Anyone can read that bucket ^[3]. Writing to it or deleting from it takes a copy of the app and the work of extracting the credentials. No account or intrusion is involved ^[1]. CISA classes the two flaws as CWE-732, incorrect permission assignment for a critical resource, and CWE-798, use of hard-coded credentials ^[12].

According to CISA, exploitation could let attackers access, modify or delete user data and critical system files, "potentially compromising the operation of the entire platform" ^[2]. The advisory does not say whether dashcams fetch firmware from that bucket, or whether they verify a signature before installing it. A tampered file reaches a vehicle only if the first is true and the second is not.

The advisory's remedy for users is to contact Viidure customer support ^[7]. The rest of CISA's guidance is its standard list for control systems: keep devices off the internet, put them behind firewalls isolated from business networks, and use VPNs for remote access ^[11]. Each of those protects a network the operator runs. The exposed store is the platform's central backend ^[3].

That leaves users one control of their own: whether to keep using the product. Stopping limits what a fleet adds to the bucket from that day on. Records and footage already stored there stay open to any reader for as long as the permissions stand ^[4].

CISA says no known public exploitation specifically targeting these flaws has been reported to it ^[8]. The bucket answers any requester ^[4], so a plain request is enough to read it.