CVE-2025-30131

An issue was discovered on IROAD Dashcam FX2 devices

Critical · published June 26, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
51.9
In the wild
Unconfirmed
What it is

🚨 An unauthenticated file upload can turn your IROAD Dashcam FX2 into a hacker's playground! 🔥 Think of it like a delivery service accepting packages with no ID check — once those packages are in, the recipient can do whatever they want inside your home. In this case, an attacker can upload a webshell to execute commands, gaining complete control over your dashcam. This is absolutely devastating! An attacker could upload malicious files to execute arbitrary commands with root privileges, granting them full access to the device. They could even install a reverse shell, allowing them to maintain persistent access and control over the dashcam. Your private moments captured by the dashcam could end up in the wrong hands, making this an urgent threat.

Put simply

Think of it like a delivery service accepting packages with no ID check — once those packages are in, the recipient can do whatever they want inside your home. In this case, an attacker can upload a webshell to execute commands, gaining complete control over your dashcam. CVE-2025-30131 involves a critical issue where an unauthenticated file upload endpoint on IROAD Dashcam FX2 devices allows attackers to upload a CGI-based webshell. This vulnerability lets them execute commands with root privileges, compromising the device entirely.

What to do

This is absolutely devastating! An attacker could upload malicious files to execute arbitrary commands with root privileges, granting them full access to the device. They could even install a reverse shell, allowing them to maintain persistent access and control over the dashcam. Your private moments captured by the dashcam could end up in the wrong hands, making this an urgent threat. To safeguard your device, patch it immediately to the latest version provided by IROAD. Additionally, ensure that file upload functionalities are secured with appropriate authentication checks to prevent this exploit. Regularly monitor your device's firmware for updates and security advisories. You've got this! Follow these steps, and you'll keep your dashcam and data safe from prying eyes! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00682 · 51.9th percentile
Published
2025-06-26T00:00Z
EPSS history
Timeline
  • 26 JUN 00:00Z
    An issue was discovered on IROAD Dashcam FX2 devices
    cvelistv5