IROAD Dash Cam Series Vulnerability Advisory: CVE-2025-2341 to 30135 (RCE/Unauth Access)

Critical Vulnerability Information IROAD X Series 1. CVE-2025-2341: Default Credentials for SSID - Issue: The device uses default SSID credentials that cannot be changed. - Impact: Attackers can connect to the device's network without authentication. 2. CVE-2025-2342: Hardcoded Credentials in APK - Issue: Firmware versions 5.2.2 and below contain hardcoded credentials, allowing unauthorized access to ports 9090 and 9092. - Impact: Attackers can access the device through these ports. 3. CVE-2025-2343: Bypassing Device Pairing - Issue: By modifying the MAC address verification mechanism, attackers can bypass the pairing process. - Impact: Attackers can take control of the device and access its functionalities. 4. CVE-2025-2344: Remote Dumping of Video Clips and Live Video Streams - Issue: The device allows remote access to recorded and live video streams. - Impact: Attackers can access video data without authorization. 5. CVE-2025-2345: Management Settings Leading to Sensitive Data Exposure and Vehicle Battery Damage - Issue: The device allows users to modify system settings, potentially leading to privacy breaches and physical damage. - Impact: Attackers can control the device and may damage the vehicle’s battery. 6. CVE-2025-2346: Public Domain Used for Internal Domain - Issue: The device uses a public domain as an internal domain, posing security risks. - Impact: May lead to DNS hijacking and man-in-the-middle attacks. IROAD FX2 7. CVE-2025-2347: Bypassing Device Pairing/Registration - Issue: A vulnerability in the pairing process allows unauthorized access to the HTTP server. - Impact: Attackers can bypass pairing and access device functionalities. 8. CVE-2025-2348: Unauthorized File Dumping via HTTP and RTSP - Issue: The device allows unauthorized access to files via HTTP and RTSP interfaces. - Impact: Attackers can download and upload files, leading to data leakage. 9. CVE-2025-2349: Exposed Root Password - Issue: The root password is exposed in the device’s configuration file. - Impact: Attackers can use this password to gain full control over the device. 10. CVE-2025-2350: Unauthorized File Upload - Issue: The device allows unauthorized users to upload arbitrary files. - Impact: Attackers can upload malicious files, leading to device compromise. 11. CVE-2025-30131: Unrestricted Webshell Access - Issue: The device allows access to an unrestricted webshell via a specific URL. - Impact: Attackers can execute arbitrary commands and take control of the device. 12. CVE-2025-30133: Unprotected URL Shortcuts - Issue: The device allows access to critical files via unprotected URL shortcuts. - Impact: Attackers can download and modify critical files, leading to device compromise. 13. CVE-2025-30135: Locking Device Owner (DoS) - Issue: After password change, the device cannot be recovered, resulting in a denial-of-service condition. - Impact: Once the password is changed, the device becomes permanently locked and unrecoverable.

Goal Reached Thanks to every supporter — we hit 100%!

IROAD Dash Cam Series Vulnerability Advisory: CVE-2025-2341 to 30135 (RCE/Unauth Access)

More from this source