PT-2025-11607 · Iroad · Iroad

Published 2025-03-18 · Updated 2025-03-24 · CVE-2025-30111

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IROAD version v9

Description The issue allows unauthorized users to remotely access and dump video footage and live video streams from the device. This is possible due to exposed endpoints that do not require proper authentication, enabling unauthorized users to list and download recorded videos as well as access live video streams.

Recommendations For IROAD version v9, consider restricting access to the exposed endpoints until a proper fix is available. As a temporary workaround, restrict access to the device to minimize the risk of unauthorized video footage and live stream access.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-30111

Affected Products

Iroad

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-30111 · Security Note
• https://t.me/cvedetector/20579 · Telegram Post
• https://iroad-dashcam.nl/iroad/iroad-x5 · Note
• https://t.me/cvenotify/115996 · Telegram Post
• https://github.com/geo-chen/IROAD-V · Note
• https://t.me/cvetracker/19373 · Telegram Post
• https://twitter.com/CVEnew/status/1902009885010583573 · Twitter Post