PT-2025-11398 · Iroad · Iroad Dash Cam X5+1

Geochen · Published 2025-03-16 · Updated 2025-03-16 · CVE-2025-2344

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: IROAD Dash Cam X5 and Dash Cam X6 up to 20250308

Description: A critical issue has been found in the affected devices, related to some unknown functionality of the component API Endpoint, leading to missing authentication. The attack may be launched remotely. The vendor was contacted about this disclosure but did not respond.

Recommendations: For IROAD Dash Cam X5 and Dash Cam X6 up to 20250308, as a temporary workaround, consider restricting access to the API Endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2025-2344

Affected Products

Iroad Dash Cam X5

Iroad Dash Cam X6

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-2344 · Security Note
• https://vuldb.com/?ctiid.299810 · Note
• https://vuldb.com/?id.299810 · Note
• https://github.com/geo-chen/IROAD#finding-4-remotely-dump-video-footage-and-live-video-stream · Note
• https://t.me/cvenotify/114961 · Telegram Post
• https://t.me/cvetracker/19232 · Telegram Post
• https://vuldb.com/?submit.516882 · Note
• https://t.me/cvedetector/20414 · Telegram Post
• https://twitter.com/CVEnew/status/1901337218251379102 · Twitter Post