PT-2025-11405 · Iroad · Iroad Dash Cam Fx2

Published 2025-03-16 · Updated 2025-11-06 · CVE-2025-2350

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: IROAD Dash Cam FX2 up to 20250308

Description: A critical issue affects some unknown functionality of the file /action/upload file, leading to unrestricted upload. Access to the local network is required for this attack to succeed. The estimated number of potentially affected devices worldwide is not specified.

Recommendations: For IROAD Dash Cam FX2 up to 20250308, as a temporary workaround, consider restricting access to the /action/upload file endpoint until a patch is available. Avoid using the affected functionality of the file /action/upload file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-2350

Affected Products

Iroad Dash Cam Fx2

References · 11

• 🔥 https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-11-unrestricted-webshell · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-2350 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2350 · Vendor Advisory
• https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-10-unauthenticated-uploads · Note
• https://vuldb.com/?id.299816 · Note
• https://t.me/cveNotify/141991 · Telegram Post
• https://t.me/cvenotify/114967 · Telegram Post
• https://t.me/cvetracker/19238 · Telegram Post
• https://vuldb.com/?ctiid.299816 · Note
• https://t.me/cvedetector/20418 · Telegram Post
• https://twitter.com/CVEnew/status/1901396360265609584 · Twitter Post