PT-2025-30921 · Iroad · Iroad Dash Cam Fx2

Geo-Chen · Published 2025-07-25 · Updated 2025-11-06 · CVE-2025-30135

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions IROAD Dashcam FX2 (affected versions not specified)

Description The IROAD Dashcam FX2 devices are affected by an issue where files can be dumped over HTTP and RTSP without authentication. The devices lack authentication controls on their HTTP and RTSP interfaces, allowing attackers to retrieve sensitive files and video recordings. An attacker can download all stored video recordings in an unencrypted manner by connecting to the ''http://192.168.10.1/mnt/extsd/event/'' endpoint. Additionally, the RTSP stream on port 8554 is accessible without authentication, enabling an attacker to view live footage. The vulnerable parameters are not explicitly mentioned.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-30135

Affected Products

Iroad Dash Cam Fx2

References · 7

• 🔥 https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-13---cve-2025-30135-locking-owner-out-of-device-dos · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-30135 · Security Note
• https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-8-dumping-files-over-http-and-rtsp-without-authentication · Note
• https://t.me/cveNotify/141995 · Telegram Post
• https://iroadau.com.au/downloads · Note
• https://twitter.com/CVEnew/status/1948859498854318409 · Twitter Post
• https://twitter.com/cracbot/status/1950511791106412835 · Twitter Post