PT-2025-11605 · Iroad Apk · Iroad Apk

Published 2025-03-18 · Updated 2025-03-18 · CVE-2025-30109

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IROAD APK version 5.2.5

Description The mobile application for the dashcam contains hardcoded credentials that allow an attacker on the local Wi-Fi network to access API endpoints and retrieve sensitive device information, including live and recorded footage. The hardcoded credentials are for ports 9091 and 9092.

Recommendations For IROAD APK version 5.2.5, consider restricting access to ports 9091 and 9092 to minimize the risk of exploitation. As a temporary workaround, avoid using the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-30109

Affected Products

Iroad Apk

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-30109 · Security Note
• https://iroad-dashcam.nl/iroad/iroad-x5 · Note
• https://t.me/cvetracker/19371 · Telegram Post
• https://github.com/geo-chen/IROAD-V · Note
• https://twitter.com/CVEnew/status/1902005982563094706 · Twitter Post
• https://t.me/cvedetector/20584 · Telegram Post