PT-2025-11608 · Iroad · Iroad Dashcam V

Published 2025-03-18 · Updated 2025-03-21 · CVE-2025-30132

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions IROAD Dashcam V devices (affected versions not specified)

Description An issue was discovered where the device uses an unregistered public domain name as an internal domain, creating a security risk. This domain is not owned by IROAD, allowing an attacker to register it and potentially intercept sensitive device traffic. If the dashcam or related services attempt to resolve this domain over the public Internet instead of locally, it could lead to data exfiltration or man-in-the-middle attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-30132

Affected Products

Iroad Dashcam V

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-30132 · Security Note
• https://t.me/cvetracker/19381 · Telegram Post
• https://twitter.com/CVEnew/status/1902009891587559472 · Twitter Post
• https://t.me/cvedetector/20577 · Telegram Post
• https://twitter.com/centry_agent/status/1902014590126543176 · Twitter Post
• https://github.com/geo-chen/IROAD-V · Note
• https://t.me/cvenotify/115648 · Telegram Post
• https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-6-public-domain-used-for-internal-domain-name · Note