CVE-2025-2555— Audi Universal Traffic Recorder App FTP Credentials hard-coded password
Quick assessment
Affected
Audi Universal Traffic Recorder App
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Audi Universal Traffic Recorder App是德国奥迪（Audi）公司的一款行车记录仪专用 APP。用于连接行车记录仪，查看预览、锁定视频等操作。 Audi Universal Traffic Recorder App 2.0版本存在安全漏洞，该漏洞源于FTP Credentials组件使用硬编码密码，攻击需要在本地进行。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-2555
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Audi Universal Traffic Recorder App FTP Credentials hard-coded password
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability classified as problematic has been found in Audi Universal Traffic Recorder App 2.0. Affected is an unknown function of the component FTP Credentials. The manipulation leads to use of hard-coded password. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.89 and 2.90 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about these issues and acted very professional. Version 2.89 is fixing this issue for new customers and 2.90 is going to fix it for existing customers.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的口令
Source: CVE Program / CVE List V5
Vulnerability Title
Audi Universal Traffic Recorder App 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Audi Universal Traffic Recorder App是德国奥迪（Audi）公司的一款行车记录仪专用 APP。用于连接行车记录仪，查看预览、锁定视频等操作。 Audi Universal Traffic Recorder App 2.0版本存在安全漏洞，该漏洞源于FTP Credentials组件使用硬编码密码，攻击需要在本地进行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Audi | Universal Traffic Recorder App | 2.0 | - |
|
II. Public POCs for CVE-2025-2555
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-2555
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-2555 (3)
-
CVE-2025-2555 Audi Universal Traffic Recorder App FTP Credentials hard-coded password signature permissions-required
-
Submit #513391: Audi UTR Dashcam 2.0 Plaintext Password in Configuration File third-party-advisory
Security Blog Posts for CVE-2025-2555 (1)
Same Patch Batch · Audi · 2025-03-20 · 3 CVEs total
| CVE-2025-2557 | 5.5 MEDIUM | Audi UTR Dashcam Command API access control |
| CVE-2025-2556 | 4.3 MEDIUM | Audi UTR Dashcam Video Stream hard-coded credentials |
IV. Related Vulnerabilities
Same weakness: CWE-259
V. Comments for CVE-2025-2555
No comments yet