PT-2025-11372 · Iroad · Iroad Dash Cam X5+1

Geochen · Published 2025-03-15 · Updated 2025-03-17 · CVE-2025-2345

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IROAD Dash Cam X5 and Dash Cam X6 up to 20250308

Description A very critical vulnerability was found in IROAD Dash Cam X5 and Dash Cam X6, affecting an unknown part. The manipulation leads to improper authorization, and it is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2025-2345

Affected Products

Iroad Dash Cam X5

Iroad Dash Cam X6

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2025-2345 · Security Note
• https://twitter.com/CveFindCom/status/1901348051115188515 · Twitter Post
• https://t.me/cvenotify/114962 · Telegram Post
• https://t.me/cvetracker/19233 · Telegram Post
• https://vuldb.com/?submit.516883 · Note
• https://twitter.com/SystemTek_UK/status/1901635234002878478 · Twitter Post
• https://vuldb.com/?id.299811 · Note
• https://github.com/geo-chen/IROAD/blob/main/README.md#finding-5-managing-settings-to-obtain-sensitive-data-and-sabotaging-car-battery · Note
• https://t.me/cvedetector/20417 · Telegram Post
• https://t.me/latest_high_impact_cve/1976 · Telegram Post
• https://twitter.com/vulns_space/status/1901353075643707751 · Twitter Post
• https://vuldb.com/?ctiid.299811 · Note
• https://twitter.com/CVEnew/status/1901345757015494675 · Twitter Post
• https://twitter.com/vuldb/status/1900997567191883835 · Twitter Post
• https://twitter.com/gothburz/status/1901732933808816167 · Twitter Post