CVE-2025-2343CWE-259CWE-798

IROAD Dash Cam X5/Dash Cam X6 Device Pairing hard-coded credentials

High · published March 16, 2025

CVSS v4.0
7.7
EPSS
0%
Percentile
28.5
In the wild
Unconfirmed
What it is

A vulnerability classified as critical was found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this vulnerability is an unknown functionality of the component Device Pairing. The manipulation leads to hard-coded credentials. Access to the local network is required for this attack to succeed. The complexity of an attack is rather high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00359 · 28.5th percentile
Weaknesses
CWE-259 · Use of Hard-coded Password; CWE-798 · Use of Hard-coded Credentials
Published
2025-03-16T17:31Z
EPSS history
Timeline
  • 16 MAR 17:31Z
    IROAD Dash Cam X5/Dash Cam X6 Device Pairing hard-coded credentials
    cvelistv5