PT-2025-31107 · Iroad · Iroad Dash Cam Fx2

Published 2025-07-28 · Updated 2025-11-06 · CVE-2025-30133

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IROAD Dashcam FX2 (affected versions not specified)

Description An issue exists in IROAD Dashcam FX2 devices that allows bypassing the device pairing and registration process. The device requires registration through the "IROAD X View" application for authentication, but the HTTP server does not enforce this restriction. An attacker connecting to the dashcam's Wi-Fi network using the default password (qwertyuiop) can directly access the HTTP server at the API endpoint http://192.168.10.1 without completing the pairing process. The device does not generate any alerts when an unauthorized connection occurs, resulting in a silent intrusion.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-30133

Affected Products

Iroad Dash Cam Fx2

References · 7

• 🔥 https://github.com/geo-chen/IROAD/blob/main/README.md#finding-12---cve-2025-30133-unprotected-url-shortcut · Exploit
• 🔥 https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-7-bypass-of-device-pairingregistration-for-iroad-fx2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-30133 · Security Note
• https://twitter.com/CVEnew/status/1949837459337970061 · Twitter Post
• https://iroadau.com.au/downloads · Note
• https://twitter.com/VulmonFeeds/status/1949959717788291398 · Twitter Post
• https://t.me/cveNotify/141996 · Telegram Post