CVE-2025-2345CWE-266CWE-285

IROAD Dash Cam X5/Dash Cam X6 improper authorization

Critical · published March 16, 2025

CVSS v4.0
9.3
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

🚨 An improper authorization vulnerability in IROAD Dash Cam X5 and X6 models could let attackers remotely access sensitive features! 🔥 Think of it like having a car with a remote start feature that could be triggered by anyone with the right code—if they get that code, they can take control without you knowing! An attacker could potentially gain complete control over your dash cam, accessing private videos and altering settings without your consent. This could lead to serious privacy violations or misuse of recorded footage, putting you at risk both online and in real life.

Put simply

Think of it like having a car with a remote start feature that could be triggered by anyone with the right code—if they get that code, they can take control without you knowing! This vulnerability allows unauthorized remote access to the IROAD Dash Cam systems due to missing or ineffective authorization checks, meaning attackers can manipulate the device without having valid credentials.

What to do

An attacker could potentially gain complete control over your dash cam, accessing private videos and altering settings without your consent. This could lead to serious privacy violations or misuse of recorded footage, putting you at risk both online and in real life. To protect yourself, immediately update your device firmware to the latest version released after March 8, 2025, and consider monitoring your device settings for any unauthorized changes. If the vendor remains unresponsive, keep your device disconnected from the internet when not in use. You've got this! By staying on top of updates and monitoring your devices, you can keep your privacy intact! 🛡️

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00757 · 54.7th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization
Published
2025-03-16T18:31Z
EPSS history
Timeline
  • 16 MAR 18:31Z
    IROAD Dash Cam X5/Dash Cam X6 improper authorization
    cvelistv5